Created tracking issue: #1658

I'm worried about exposing credentials in such way (It can be even downloaded via save-failed-tree task by anyone - with proper config it should work anyway). On the other hand, I've no better idea now, so if there is some other +1, I'm ok with merging it.

@mikem @breilly @julian8628

There are a variety of ways that credentials could be exfiltrated even if you don't allow save-failed-tree. However, the alternative is to provide credential-free access to anything "make sources" is allowed to see, which won't fly.

I considered more elaborate means of handling this, but it essentially boils down to the same thing; "make sources" has access to the credentials.

(Unless and until we can have SELinux inside the mock environment, at which point combining that with enforcing gpg signatures when installing packages to generate the mock environment with appropriate policies would allow the credentials to be accessed only by known "safe" utilities, but save-failed-tree probably doesn't work so well any more then)

Ultimately the purpose of these credentials is to satisfy an auditing requirement, and I'm expecting them to be changed regularly by an automated process.

Ok, :thumbsup:

Better to be None

Can we have some warning in docs to indicate the potential risks?

It is also possible to expose the credentials by some aforethought make_source_cmd

fixes: #1658

Commit 160780ce fixes this pull-request