debian:apt-authentication

# Category: `debian:apt-authentication`

This asset stores authentication data that can be used by tasks that need to authenticate to an external APT repository, such as APTMirror.

- Data:

  - `auth_scheme` (string): the authentication scheme; at present this may only be `basic`, but this field exists in case APT adds other authentication schemes in future

  - `name` (string): the name of these credentials, used to identify the asset in tasks

  - `credentials` (dictionary): secret scheme-dependent credentials

For `auth_scheme: basic`, the `credentials` field is as follows:

> - `username` (string)

> - `password` (string)

This asset must be in a workspace, and only a single asset with a given name can exist in a given workspace. In task data, the asset may be identified either as `name` (in which case it is looked up in the same workspace as the task) or as `workspace:name` (in which case it is looked up in the named workspace in the same scope as the task).

This asset may be used by the owner of that workspace, or by members of groups to which the `APT_AUTHENTICATOR` role has been granted via an `AssetUsage` row.

To ensure that credentials are not exposed in logs, tasks must take care to provide them to APT using the apt_auth.conf(5) mechanism.

Since Basic authentication is sent in cleartext (see RFC 7617), APT will only use it with repositories accessed over HTTPS (unless an explicit protocol is specified in `/etc/apt/auth.conf.d/`, which tasks should not do). Tasks may add their own checks for this in order to provide better error handling.