← Back to issue list

Add authentication support to apt repositories

View original Github issue

Metadata

Project
snapcraft
Number
#5116
Type
issue
State
open
Author
cparich
Labels
—
Created
Updated
Closed
—

Current evaluation

Feature request: add auth.conf.d-style authentication support for type: apt package-repositories, since embedding credentials in the URI leaks secrets into build logs and long keys cause errors. Open 685 days, no labels, no maintainer response, no related PR found.

Suggested action: needs triage

Reason: The issue is a well-scoped feature request (auth.conf.d support for apt package-repositories) with a concrete pain point (secret leakage in logs, 'File name too long' with JFrog keys), but it has no labels, no maintainer comments, and no linked PR after 685 days. Code inspection confirms no auth.conf handling exists in snapcraft or craft-parts' repo.install path, so it is not implemented. It needs maintainer triage to decide scope (likely a craft-parts API change plus snapcraft schema/docs).

Impact: 50 Quick Win: 22.5 Staleness: 80 Complexity: 55 Confidence: 70 Support Request: 10

Issue body

### What needs to get done Apt repositories support authentication via options in sources.list or files in /etc/apt/auth.conf and /etc/apt/auth.conf.d Add an authentication mechanism for `type: apt` entries in package-repositories that takes an auth.conf.d formatted file ### Why it needs to get done Snapcraft doesn't restrict a workaround where you can put the authentication details into the URI like `https://<user>:<pass>@example.com/repo` however it does embed the secret into the build log, and some services like JFrog generate large keys which will lead to a "File name too long" error. When embedding the secret into the URI, the build log might look something like this: ``` 2024-10-15 09:27:46.009 :: 2024-10-15 09:27:41.189 Processing repo: PackageRepositoryApt(type='apt', priority=None, url='https://***:***@example.com/path', key_id='***', architectures=None, formats=None, path=None, components=['main'], key_server=None, suites=['jammy'], pocket=None, series=None) ``` Further, without an authentication file, developers have to resort to workarounds like `sed 's/{{AUTH}}/$PASS/' snap/local/snapcraft.yaml.in > snap/snapcraft.yaml` in order to maintain different authentication sets between local developers and build servers.

Evaluation history

Date Model Scores Action Summary
qwen/qwen3.8-27b
Impact: 50
Quick Win: 22.5
Staleness: 80
Complexity: 55
Confidence: 70
Support Request: 10
needs triage Feature request: add auth.conf.d-style authentication support for type: apt package-repositories, since embedding credentials in the URI leaks secrets into build logs and long keys cause errors. Open 685 days, no labels, no maintainer response, no related PR found.
qwen/qwen3.6-35b-a3b
Staleness: 85
Complexity: 65
Confidence: 90
Support Request: 10
needs triage Feature request to add apt repository authentication via auth.conf.d files in snapcraft. Currently unlabelled, inactive for 644 days, and awaiting maintainer review.
qwen3.6-35b-a3b-mtp-q6
Staleness: 95
Complexity: 60
Confidence: 85
Support Request: 10
needs triage Feature request to add apt repository authentication via auth.conf.d files to prevent credential leakage in build logs. Untriaged, unlabelled, and inactive for over 1.7 years.
qwen3.6-35b-a3b-mtp-q6
Staleness: 90
Complexity: 50
Confidence: 85
Support Request: 10
needs triage Add apt repository authentication via auth.conf.d files to prevent secret embedding in URIs, which leaks logs and causes filename errors. Open, unassigned, and inactive for over a year, awaiting triage and assignment.

Update history

No update history recorded yet.

Related issues

Issue Project State Summary Similarity
#221 Support adding private repositories craft-archives open Enhancement to support adding private apt repositories with authentication via /etc/apt/auth.conf.d, including private PPAs. Triaged by maintainer, Jira ticket CRAFT-5074 created, no implementation work started.
71%