[PATCH v2 0/1] rootfs: clean apt auth credentials from final rootfs by default

[Gourav Singh]

v2 changes:
- Model cleanup as a ROOTFS_FEATURES entry 'clean-apt-credentials'
instead of a standalone ISAR_APT_CLEAN_AUTH_FILES variable
- Move handler to do_rootfs_postprocess (runs after all package
installs, safe to remove auth at that point)
- Enable the feature in image.bbclass and sdk.bbclass
- Update RECIPE-API-CHANGELOG.md accordingly

Gourav Singh (1):
rootfs: clean apt auth credentials from final rootfs by default

RECIPE-API-CHANGELOG.md | 18 ++++++++++++++++++
meta/classes-recipe/image.bbclass | 1 +
meta/classes-recipe/rootfs.bbclass | 6 ++++++
meta/classes-recipe/sdk.bbclass | 2 +-
4 files changed, 26 insertions(+), 1 deletion(-)

--
2.39.5

[Gourav Singh]

When ISAR_APT_CREDS is configured, apt writes authentication
credentials to /etc/apt/auth.conf.d/isar.conf in the rootfs
during the build. Add a `clean-apt-credentials` rootfs feature to
rootfs.bbclass that removes this file during do_rootfs_postprocess
to prevent credentials from being shipped in the final image or
SDK sysroot.

Enable the feature by default in image.bbclass and sdk.bbclass.
Document the feature and opt-out in RECIPE-API-CHANGELOG.md.

Signed-off-by: Gourav Singh <goura...@siemens.com>
---

RECIPE-API-CHANGELOG.md | 18 ++++++++++++++++++
meta/classes-recipe/image.bbclass | 1 +
meta/classes-recipe/rootfs.bbclass | 6 ++++++
meta/classes-recipe/sdk.bbclass | 2 +-
4 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/RECIPE-API-CHANGELOG.md b/RECIPE-API-CHANGELOG.md
index f5b84c84..19eada4a 100644
--- a/RECIPE-API-CHANGELOG.md
+++ b/RECIPE-API-CHANGELOG.md
@@ -1137,3 +1137,21 @@ targeting Microsoft Hyper-V virtual machines on amd64.
The machine produces a `.vhdx` disk image using the WIC image type
and GRUB as the bootloader. It supports Debian bullseye, bookworm
and trixie.
+
+### Automatic cleanup of APT authentication credentials
+
+A new rootfs feature `clean-apt-credentials` has been added to
+`rootfs.bbclass`. When enabled, it removes
+`/etc/apt/auth.conf.d/isar.conf` from the rootfs during
+`do_rootfs_postprocess`, ensuring that APT authentication
+credentials set via `ISAR_APT_CREDS` are not shipped in the
+final image or SDK sysroot.
+
+The feature is enabled by default in `image.bbclass` and
+`sdk.bbclass` via `ROOTFS_FEATURES`.
+
+To opt out, remove the feature explicitly:
+
+```
+ROOTFS_FEATURES:remove = "clean-apt-credentials"
+```
diff --git a/meta/classes-recipe/image.bbclass b/meta/classes-recipe/image.bbclass
index edd4f888..d02f99da 100644
--- a/meta/classes-recipe/image.bbclass
+++ b/meta/classes-recipe/image.bbclass
@@ -102,6 +102,7 @@ ROOTFS_FEATURES += "\
clean-debconf-cache \
populate-systemd-preset \
generate-sbom \
+ clean-apt-credentials \
"
ROOTFS_PACKAGES += "${IMAGE_PREINSTALL} ${@isar_multiarch_packages('IMAGE_INSTALL', d)}"
ROOTFS_VARDEPS += "IMAGE_INSTALL"
diff --git a/meta/classes-recipe/rootfs.bbclass b/meta/classes-recipe/rootfs.bbclass
index e17f711f..0845320e 100644
--- a/meta/classes-recipe/rootfs.bbclass
+++ b/meta/classes-recipe/rootfs.bbclass
@@ -35,6 +35,7 @@ ROOTFS_BASE_DISTRO ?= "${BASE_DISTRO}"
# 'export-dpkg-status' - exports /var/lib/dpkg/status file to ${ROOTFS_DPKGSTATUS_DEPLOY_DIR}
# 'clean-log-files' - delete log files that are not owned by packages
# 'populate-systemd-preset' - enable systemd units according to systemd presets
+# 'clean-apt-credentials' - remove apt auth credentials written by ISAR_APT_CREDS

# only supported from bookworm / jammy on
ROOTFS_FEATURES:remove:buster = "generate-sbom"
@@ -531,6 +532,11 @@ rootfs_postprocess_clean_debconf_cache() {
run_privileged rm -rf "${ROOTFSDIR}/var/cache/debconf/"*
}

+ROOTFS_POSTPROCESS_COMMAND += "${@bb.utils.contains('ROOTFS_FEATURES', 'clean-apt-credentials', 'rootfs_postprocess_clean_apt_credentials', '', d)}"
+rootfs_postprocess_clean_apt_credentials() {
+ run_privileged rm -f "${ROOTFSDIR}/etc/apt/auth.conf.d/isar.conf"
+}
+
ROOTFS_POSTPROCESS_COMMAND += "${@bb.utils.contains('ROOTFS_FEATURES', 'clean-pycache', 'rootfs_postprocess_clean_pycache', '', d)}"
rootfs_postprocess_clean_pycache() {
run_privileged find ${ROOTFSDIR}/usr -type f -name '*.pyc' -delete -print
diff --git a/meta/classes-recipe/sdk.bbclass b/meta/classes-recipe/sdk.bbclass
index 7a8d5ff4..d79de2bf 100644
--- a/meta/classes-recipe/sdk.bbclass
+++ b/meta/classes-recipe/sdk.bbclass
@@ -49,7 +49,7 @@ ROOTFS_ARCH:class-sdk = "${HOST_ARCH}"
ROOTFS_DISTRO:class-sdk = "${@get_rootfs_distro(d)}"
ROOTFS_PACKAGES:class-sdk = "sdk-files ${SDK_TOOLCHAIN} ${SDK_PREINSTALL} ${@isar_multiarch_packages('SDK_INSTALL', d)}"
ROOTFS_VARDEPS:class-sdk = "SDK_INSTALL SDK_INCLUDE_ISAR_APT"
-ROOTFS_FEATURES:append:class-sdk = " clean-package-cache generate-manifest export-dpkg-status generate-sbom"
+ROOTFS_FEATURES:append:class-sdk = " clean-package-cache generate-manifest export-dpkg-status generate-sbom clean-apt-credentials"
ROOTFS_MANIFEST_DEPLOY_DIR:class-sdk = "${DEPLOY_DIR_SDKCHROOT}"
ROOTFS_DPKGSTATUS_DEPLOY_DIR:class-sdk = "${DEPLOY_DIR_SDKCHROOT}"

--
2.39.5