From patchwork Thu Jul 23 07:06:14 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Singh, Gourav" X-Patchwork-Id: 5276 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Thu, 23 Jul 2026 09:06:46 +0200 X-Sieve: CMU Sieve 2.4 Received: from mail-wm1-f64.google.com (mail-wm1-f64.google.com [209.85.128.64]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 66N76j7V007237 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Thu, 23 Jul 2026 09:06:45 +0200 Received: by mail-wm1-f64.google.com with SMTP id 5b1f17b1804b1-4955edc851asf1826875e9.2 for ; Thu, 23 Jul 2026 00:06:45 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1784790400; cv=pass; d=google.com; s=arc-20260327; b=loJUaIPDMsxZ7SSA6tLoLCO/YSdpJHf2AQcbrhcJBxt2IVYjwqbYUmscD5UlFRczJP PznjafIuEXLHjFRPot8vJn06lk7e8SuT8DKbxv45KhvUEQ6Q23Qvet/9ufgaKUC1OJDp PbJNDtsnrEcM8QZGAcWiQhHmyR8IIv2nv3wglHaxybIPLE+8GsxiLCfkQp5z4WsNqTSa Dpmcfs5hz8sKLSQzerGxBeIHYt7+opkG6uLBidY50B6CT42FgFd0izhbzv/zWda5975t mud0GA1WLpgLwviHLXY9L1+QXh81JsNOqowt1QRvnp8wzwZXEtcCvYHbSScamXFvZAlb ZSfw== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:feedback-id:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=Bl8kLdMzOUi7nvLXlj2dT94jeotEhBhzlriS5w2AOSw=; fh=kgnXZb11/7/Isim4HkFUhWfJBFmIgKa1AhCLdFkcSik=; b=mTaqsCXzNf1gnIz6MINCkKWmXyu4huMp466u9CUNuprWl22YUGiNFDRjo6yaLP3KKw oya0eveDaJHuphvLNqNhyc2ABXTQsqJXslMBbk62yFTkNBnq4jV3lbdfumKAz5uLxB5H JK9vvY4Lmn3RGzBl25i3AGQcGjmF4AVzi2kQR48/0Ble8hBJLUAaXj207Ww07jKyYrfg PQeRZj4C09l2GFXqTFuFDODARLdhJInPADUeSIzD+WEgWnS4E+xQTGWZojzy7SkeNJHA ulKkzwzXKFwEPd0fuZaJEzwUTKYcHAtpKPj1ytfGTbk20NDb8KXQN1u3cNjtc18ZrdgT FtyQ==; darn=isar-build.org ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=fm1 header.b=NOOhgE7A; spf=pass (google.com: domain of fm-1333022-202607230706359c05e51cb30002075f-m37i7y@rts-flowmailer.siemens.com designates 185.136.64.227 as permitted sender) smtp.mailfrom=fm-1333022-202607230706359c05e51cb30002075f-M37I7Y@rts-flowmailer.siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1784790400; x=1785395200; darn=isar-build.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:content-type:reply-to :x-original-authentication-results:x-original-sender:feedback-id :mime-version:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=Bl8kLdMzOUi7nvLXlj2dT94jeotEhBhzlriS5w2AOSw=; b=fLWSuEnPf+iykwkcvwXONc1IB6nUn09zyTFMxISXXMnQ/BOsQJOZOObXeFl44etpL4 3skuzceT9RYFacNrjuTXaDiv0Mv8aePHybKErym2bO0wiJQB6Cb0cxlan9wuHYkXoTbN ANRJK1KVD9q5RbZ6vcqrIirRl0Zetr+9XQ4lXxjhZOYpweou9qyGVOj1Qw+lH8rjwPXj tDuOPRVyLma3l/QxCKa7J4GCDB65BcmhIgCGfylMGX4/Ov9sdh151jaW2mBRSa0bCF0j UbtbxLYghI/8HZeTof9HN3qj++qlmRb3QD61x4lf7oqxv5rggROBNG7qfneM7VmfSnip ktXg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784790400; x=1785395200; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence :content-type:reply-to:x-original-authentication-results :x-original-sender:feedback-id:mime-version:message-id:date:subject :cc:to:from:x-beenthere:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Bl8kLdMzOUi7nvLXlj2dT94jeotEhBhzlriS5w2AOSw=; b=KEzI9pI8XNy/qNRtr6cxs6oEhPiWMp+NQYF1qwX377ix5TIkVZV+bXPMyKV6HCUHE3 pz/gdE805AVZqP5FXluq6cbt/+j4nzXMgmtBCPmswQ1X3FlQWo8MKwEAwNHM6NN/0na0 z5+vj4MVlLNgFYrGY7baDLI3xk3hrPwIjBzk9O0rnBjZWFaG1CeRCsbrDIgXJtqY4dbH I28tHipWLimxyFABTgxFHwGJ3CAxDLDBlaaEvdFxDPf0EqUimq4eOLy1OLfrkGirfAEU K1xztX0KVX9w919+TGc5YssKGWQokuYbMyBozmjLiNVbGYJIca7PQM1nqnMkyjhxaoww 0J8Q== X-Forwarded-Encrypted: i=2; AHgh+RodS9gU93m6umHij0UWKzLS1CUD1xPq/kODDqtkTyiV2gdPKoKFi6kd/BpwDK3Al5VAQLDyy8A=@isar-build.org X-Gm-Message-State: AOJu0YwjHcLIy9OkULMdxMW/9vjNbAkaSScTS9DCJlsBtcq+UNJG5RMb EeQ6o0OOnyZQFV8r1ZoMdReVuADANUvkHfBOFyHpPxc6lGI7VvwzZ1Tg X-Received: by 2002:a05:600c:3b0a:b0:495:4b42:8677 with SMTP id 5b1f17b1804b1-49573cd8ab0mr18193585e9.18.1784790399509; Thu, 23 Jul 2026 00:06:39 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="Aa7YSPTMXCMSU8pKFJwDBsHmB1/oi+vkwPYiF+qVMpn2cofCWg==" Received: by 2002:a05:600d:104:b0:495:5e9d:8a14 with SMTP id 5b1f17b1804b1-49572c08021ls3512375e9.1.-pod-prod-03-eu; Thu, 23 Jul 2026 00:06:37 -0700 (PDT) X-Received: by 2002:a05:600c:3111:b0:493:cc25:9c0e with SMTP id 5b1f17b1804b1-49573c996e7mr18470945e9.14.1784790397430; Thu, 23 Jul 2026 00:06:37 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1784790397; cv=none; d=google.com; s=arc-20260327; b=T8uEzt6Vo8rDFISv+sugIUAKERCbBys5APEzf+3h5bhG6NTo3WT4aA7puO5/Wq0thT BJLcdSxVljKuoYkorxb6R6qBZbW02vLX1V9S0dThLeWaY6O0mMLnViGUIaOhsPLZipdc GSsmD55tx9TJ0AOMp6mvDHdxuBgjfP6iy5F9gHTZxy8bFv530p/WwE9O7P61RQpQ6xDf Gkya5I1tpnwouE0ol4fu834Lubh8bYY4LrMhj/rfhCJi3omqLmOMLDOUx0d3XjUaFM1U YvQI5EKIb2/XmBPB9WbfLb5DlovSZu8gntsLf27CWk5ikeXfm0Ys6wgAGuG/XIDKVabu bjIw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=feedback-id:content-transfer-encoding:mime-version:message-id:date :subject:cc:to:from:dkim-signature; bh=VU3OSfblfDmvle+wWdyLYaACgnGpSGd2IWlbAohnFCk=; fh=gz0ZrJn6x76gX3XefOAliLWTyygDYYdGT/FXhQYr+zo=; b=AsHYEGvXZHt7+9X31NRqpT1nc5ErZZii50k3WkvTOakN/QTZnxG5x1WpgRE8y1kb8Q oWzyAoLEj/WinayOLfX50x0DYsfh0PdtUXxqgPpJkxDDxAOpspg/tDPoyrEXDQuFsjni L5grVYnn2xq2qOFAog3Ch8DCcw1bsFn69pLMjvn+kB8sE+ajnY6ACu1humh5qQXxGOOU BqRih6uAmkxDOcjkHrboe6ZEkeyLatepAGg7EOv9jEJDeAunh/DCjZBItacIqt0hL5fu 1LmT54LDOmBNo6Ol5PiKorKO/MMF4mAKnbUv1jKm4YeiszcetPnonkYuL81f2CiZExmV vSig==; dara=google.com ARC-Authentication-Results: i=1; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=fm1 header.b=NOOhgE7A; spf=pass (google.com: domain of fm-1333022-202607230706359c05e51cb30002075f-m37i7y@rts-flowmailer.siemens.com designates 185.136.64.227 as permitted sender) smtp.mailfrom=fm-1333022-202607230706359c05e51cb30002075f-M37I7Y@rts-flowmailer.siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com Received: from mta-64-227.siemens.flowmailer.net (mta-64-227.siemens.flowmailer.net. [185.136.64.227]) by gmr-mx.google.com with ESMTPS id 5b1f17b1804b1-4956ab200b8si434285e9.1.2026.07.23.00.06.36 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 23 Jul 2026 00:06:36 -0700 (PDT) Received-SPF: pass (google.com: domain of fm-1333022-202607230706359c05e51cb30002075f-m37i7y@rts-flowmailer.siemens.com designates 185.136.64.227 as permitted sender) client-ip=185.136.64.227; Received: by mta-64-227.siemens.flowmailer.net with ESMTPSA id 202607230706359c05e51cb30002075f for ; Thu, 23 Jul 2026 09:06:35 +0200 X-Patchwork-Original-From: "'Gourav Singh' via isar-users" From: "Singh, Gourav" To: isar-users@googlegroups.com Cc: Gourav Singh Subject: [PATCH] image: clean ISAR apt auth file from final image by default Date: Thu, 23 Jul 2026 12:36:14 +0530 Message-Id: <20260723070614.161221-1-gouravsingh@siemens.com> MIME-Version: 1.0 X-Flowmailer-Platform: Siemens Feedback-ID: 519:519-1333022:519-21489:flowmailer X-Original-Sender: gouravsingh@siemens.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=fm1 header.b=NOOhgE7A; spf=pass (google.com: domain of fm-1333022-202607230706359c05e51cb30002075f-m37i7y@rts-flowmailer.siemens.com designates 185.136.64.227 as permitted sender) smtp.mailfrom=fm-1333022-202607230706359c05e51cb30002075f-M37I7Y@rts-flowmailer.siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com X-Original-From: Gourav Singh Reply-To: Gourav Singh Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Status: No, score=-4.9 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H2,RCVD_IN_RP_CERTIFIED, RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= Add ISAR_APT_CLEAN_AUTH_FILES (default: "1") in image.bbclass. When ISAR_APT_CREDS is configured and cleanup is enabled, append /etc/apt/auth.conf.d/isar.conf to ROOTFS_CLEAN_FILES so apt auth credentials are removed from the final image rootfs. Also document the new variable and opt-out behavior in RECIPE-API-CHANGELOG.md. Signed-off-by: Gourav Singh --- RECIPE-API-CHANGELOG.md | 11 +++++++++++ meta/classes-recipe/image.bbclass | 11 +++++++++++ 2 files changed, 22 insertions(+) diff --git a/RECIPE-API-CHANGELOG.md b/RECIPE-API-CHANGELOG.md index f5b84c84..348d296a 100644 --- a/RECIPE-API-CHANGELOG.md +++ b/RECIPE-API-CHANGELOG.md @@ -1137,3 +1137,14 @@ targeting Microsoft Hyper-V virtual machines on amd64. The machine produces a `.vhdx` disk image using the WIC image type and GRUB as the bootloader. It supports Debian bullseye, bookworm and trixie. + +### Automatic cleanup of APT authentication credentials + +`image.bbclass` now defines `ISAR_APT_CLEAN_AUTH_FILES ?= "1"`. +When `ISAR_APT_CREDS` is configured and +`ISAR_APT_CLEAN_AUTH_FILES` is enabled, +`/etc/apt/auth.conf.d/isar.conf` is appended to +`ROOTFS_CLEAN_FILES` so APT authentication credentials are +removed from the final image rootfs. +To keep the auth file in the image (not recommended), set +`ISAR_APT_CLEAN_AUTH_FILES = "0"`. diff --git a/meta/classes-recipe/image.bbclass b/meta/classes-recipe/image.bbclass index edd4f888..4e4c987b 100644 --- a/meta/classes-recipe/image.bbclass +++ b/meta/classes-recipe/image.bbclass @@ -109,6 +109,17 @@ ROOTFS_MANIFEST_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}" ROOTFS_DPKGSTATUS_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}" ROOTFS_PACKAGE_SUFFIX ?= "${PN}-${DISTRO}-${MACHINE}" +# If ISAR_APT_CREDS is configured, apt auth credentials are written to +# /etc/apt/auth.conf.d/isar.conf during the build. Clean that file from +# image rootfs by default to avoid shipping repository credentials. +# Set ISAR_APT_CLEAN_AUTH_FILES = "0" to opt out. +ISAR_APT_CLEAN_AUTH_FILES ?= "1" + +ROOTFS_CLEAN_FILES:append = "${@ ' /etc/apt/auth.conf.d/isar.conf' \ + if d.getVar('ISAR_APT_CREDS') \ + and bb.utils.to_boolean(d.getVar('ISAR_APT_CLEAN_AUTH_FILES')) \ + else ''}" + CACHE_DEB_SRC = "${@bb.utils.contains('BASE_REPO_FEATURES', 'cache-deb-src', '1', '0', d)}" python () { if bb.utils.to_boolean(d.getVar('CACHE_DEB_SRC')):