[PATCH] image: clean ISAR apt auth file from final image by default

[Gourav Singh]

Add ISAR_APT_CLEAN_AUTH_FILES (default: "1") in image.bbclass.
When ISAR_APT_CREDS is configured and cleanup is enabled, append
/etc/apt/auth.conf.d/isar.conf to ROOTFS_CLEAN_FILES so apt auth
credentials are removed from the final image rootfs.

Also document the new variable and opt-out behavior in
RECIPE-API-CHANGELOG.md.

Signed-off-by: Gourav Singh <goura...@siemens.com>
---
RECIPE-API-CHANGELOG.md | 11 +++++++++++
meta/classes-recipe/image.bbclass | 11 +++++++++++
2 files changed, 22 insertions(+)

diff --git a/RECIPE-API-CHANGELOG.md b/RECIPE-API-CHANGELOG.md
index f5b84c84..348d296a 100644
--- a/RECIPE-API-CHANGELOG.md
+++ b/RECIPE-API-CHANGELOG.md
@@ -1137,3 +1137,14 @@ targeting Microsoft Hyper-V virtual machines on amd64.
The machine produces a `.vhdx` disk image using the WIC image type
and GRUB as the bootloader. It supports Debian bullseye, bookworm
and trixie.
+
+### Automatic cleanup of APT authentication credentials
+
+`image.bbclass` now defines `ISAR_APT_CLEAN_AUTH_FILES ?= "1"`.
+When `ISAR_APT_CREDS` is configured and
+`ISAR_APT_CLEAN_AUTH_FILES` is enabled,
+`/etc/apt/auth.conf.d/isar.conf` is appended to
+`ROOTFS_CLEAN_FILES` so APT authentication credentials are
+removed from the final image rootfs.
+To keep the auth file in the image (not recommended), set
+`ISAR_APT_CLEAN_AUTH_FILES = "0"`.
diff --git a/meta/classes-recipe/image.bbclass b/meta/classes-recipe/image.bbclass
index edd4f888..4e4c987b 100644
--- a/meta/classes-recipe/image.bbclass
+++ b/meta/classes-recipe/image.bbclass
@@ -109,6 +109,17 @@ ROOTFS_MANIFEST_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}"
ROOTFS_DPKGSTATUS_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}"
ROOTFS_PACKAGE_SUFFIX ?= "${PN}-${DISTRO}-${MACHINE}"

+# If ISAR_APT_CREDS is configured, apt auth credentials are written to
+# /etc/apt/auth.conf.d/isar.conf during the build. Clean that file from
+# image rootfs by default to avoid shipping repository credentials.
+# Set ISAR_APT_CLEAN_AUTH_FILES = "0" to opt out.
+ISAR_APT_CLEAN_AUTH_FILES ?= "1"
+
+ROOTFS_CLEAN_FILES:append = "${@ ' /etc/apt/auth.conf.d/isar.conf' \
+ if d.getVar('ISAR_APT_CREDS') \
+ and bb.utils.to_boolean(d.getVar('ISAR_APT_CLEAN_AUTH_FILES')) \
+ else ''}"
+
CACHE_DEB_SRC = "${@bb.utils.contains('BASE_REPO_FEATURES', 'cache-deb-src', '1', '0', d)}"
python () {
if bb.utils.to_boolean(d.getVar('CACHE_DEB_SRC')):
--
2.39.5

[MOESSBAUER, Felix]

Hi,

I would rather model this as a rootfs feature instead of adding yet
another parameter. I'm currently re-modelling the rootfs features to
get reproducible sstate artifacts (currently we are creating way more
sstate artifacts than needed, simply because the output of
bootstrapping and do_rootfs_install is not reproducible).

I will send out that cleanup once the "Rework SBOM generation" is
merged.

Anyways, you can already model this as a feature and enable it in the
image recipe (and SDK! recipe).

> +
> +ROOTFS_CLEAN_FILES:append = "${@ ' /etc/apt/auth.conf.d/isar.conf' \
> + if d.getVar('ISAR_APT_CREDS') \
> + and bb.utils.to_boolean(d.getVar('ISAR_APT_CLEAN_AUTH_FILES')) \

if ${@bb.utils.contains('ROOTFS_FEATURES', 'clean-apt-credentials',
...)

Felix

> + else ''}"
> +
> CACHE_DEB_SRC = "${@bb.utils.contains('BASE_REPO_FEATURES', 'cache-deb-src', '1', '0', d)}"
> python () {
> if bb.utils.to_boolean(d.getVar('CACHE_DEB_SRC')):
> --
> 2.39.5
>

> --
> You received this message because you are subscribed to the Google Groups "isar-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+...@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260723070614.161221-1-gouravsingh%40siemens.com.

[Singh, Gourav]

Hi Felix,

Thanks for the suggestion. Updated in v2 to model this as a
`clean-apt-credentials` rootfs feature instead of a standalone
variable, enabled by default in image.bbclass and sdk.bbclass.

Best Regards,
Gourav

> +When `ISAR_APT_CREDS` is configured and `ISAR_APT_CLEAN_AUTH_FILES`
> +is enabled, `/etc/apt/auth.conf.d/isar.conf` is appended to
> +`ROOTFS_CLEAN_FILES` so APT authentication credentials are removed
> +from the final image rootfs.

> +To keep the auth file in the image (not recommended), set
> +`ISAR_APT_CLEAN_AUTH_FILES = "0"`.
> diff --git a/meta/classes-recipe/image.bbclass
> b/meta/classes-recipe/image.bbclass
> index edd4f888..4e4c987b 100644
> --- a/meta/classes-recipe/image.bbclass
> +++ b/meta/classes-recipe/image.bbclass
> @@ -109,6 +109,17 @@ ROOTFS_MANIFEST_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}"
> ROOTFS_DPKGSTATUS_DEPLOY_DIR ?= "${DEPLOY_DIR_IMAGE}"
> ROOTFS_PACKAGE_SUFFIX ?= "${PN}-${DISTRO}-${MACHINE}"
>
> +# If ISAR_APT_CREDS is configured, apt auth credentials are written

> +to # /etc/apt/auth.conf.d/isar.conf during the build. Clean that file
> +from # image rootfs by default to avoid shipping repository credentials.

[Singh, Gourav]

This patch has been superseded by v2 with an updated approach.
Please refer to the v2 thread:
https://groups.google.com/g/isar-users/c/IHlBfEK5OVU