← Back to issue list

Add authentication support to apt repositories

View original Github issue

Metadata

Project
snapcraft
Number
#5116
Type
issue
State
open
Author
cparich
Labels
—
Created
Updated
Closed
—

Current evaluation

Add auth.conf.d-style credentials to apt package-repositories; unresolved, unlabelled feature request with no maintainer response and an open craft-archives counterpart.

Suggested action: needs triage

Reason: The request is concrete: it specifies auth.conf.d formatting and explains credential leakage in logs, large-key filename failures, and the need for environment-specific credentials. However, the issue has no labels, assignee, or maintainer comments, while the current craft-archives PackageRepositoryApt model has no authentication field and no auth.conf implementation was found; the field semantics, file validation, placement, and build-environment propagation remain unspecified.

Evaluated by: mr-cal-bot

Impact: 50 Quick Win: 14 Complexity: 55 Confidence: 88 Actionability: 60

Issue body

### What needs to get done Apt repositories support authentication via options in sources.list or files in /etc/apt/auth.conf and /etc/apt/auth.conf.d Add an authentication mechanism for `type: apt` entries in package-repositories that takes an auth.conf.d formatted file ### Why it needs to get done Snapcraft doesn't restrict a workaround where you can put the authentication details into the URI like `https://<user>:<pass>@example.com/repo` however it does embed the secret into the build log, and some services like JFrog generate large keys which will lead to a "File name too long" error. When embedding the secret into the URI, the build log might look something like this: ``` 2024-10-15 09:27:46.009 :: 2024-10-15 09:27:41.189 Processing repo: PackageRepositoryApt(type='apt', priority=None, url='https://***:***@example.com/path', key_id='***', architectures=None, formats=None, path=None, components=['main'], key_server=None, suites=['jammy'], pocket=None, series=None) ``` Further, without an authentication file, developers have to resort to workarounds like `sed 's/{{AUTH}}/$PASS/' snap/local/snapcraft.yaml.in > snap/snapcraft.yaml` in order to maintain different authentication sets between local developers and build servers.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha
Impact: 50
Quick Win: 14
Complexity: 55
Confidence: 88
Actionability: 60
needs triage Add auth.conf.d-style credentials to apt package-repositories; unresolved, unlabelled feature request with no maintainer response and an open craft-archives counterpart.
qwen/qwen3.6-35b-a3b
Impact: 60
Quick Win: 21
Complexity: 50
Confidence: 75
Actionability: 70
needs triage Feature request to add authentication support for apt repositories using auth.conf.d formatted files. Unlabelled, no maintainer response after 705 days.
qwen/qwen3.8-27b
Impact: 50
Quick Win: 22
Staleness: 80
Complexity: 55
Confidence: 70
Support Request: 10
needs triage Feature request: add auth.conf.d-style authentication support for type: apt package-repositories, since embedding credentials in the URI leaks secrets into build logs and long keys cause errors. Open 685 days, no labels, no maintainer response, no related PR found.
qwen/qwen3.6-35b-a3b
Staleness: 85
Complexity: 65
Confidence: 90
Support Request: 10
needs triage Feature request to add apt repository authentication via auth.conf.d files in snapcraft. Currently unlabelled, inactive for 644 days, and awaiting maintainer review.
qwen3.6-35b-a3b-mtp-q6
Staleness: 95
Complexity: 60
Confidence: 85
Support Request: 10
needs triage Feature request to add apt repository authentication via auth.conf.d files to prevent credential leakage in build logs. Untriaged, unlabelled, and inactive for over 1.7 years.

Update history

No update history recorded yet.

Related work

  • Related To: craft-archives#221 (confidence 95%)

    Open upstream enhancement for private APT repository authentication through /etc/apt/auth.conf.d, closely matching this request.

Related issues

No related issues found above the similarity threshold.