<div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote">On 19 June 2017 at 14:20, Philip Balister <span dir="ltr"><<a href="mailto:philip@balister.org" target="_blank">philip@balister.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div id=":7vm" class="a3s aXjCH m15cc083781dc0c05">So the issue is leaking credentials, not build system paths? I mention<br>
this because we do leak build system paths into images in other places.</div></blockquote></div><br>Yes, SRC_URI can contain username/passwords, and even if you filter those out explicitly you can expose internal hostnames and so on.</div><div class="gmail_extra"><br></div><div class="gmail_extra">Ross</div></div>