cosa leaks git access tokens into generated ociarchive

[apollo13]

Cosa writes the current config source into the ociarchive:

coreos-assembler/src/cmd-build

Line 447 in 3ad4cf5

--label="org.opencontainers.image.source=${gitsrc}" \

In my case this ends up as:

"org.opencontainers.image.source": "https://gitlab-ci-token:XXXX@gitlab.instance.mine",

since I am building in gitlab CI which uses a short lived access token to check out the image. It would be great if this token could be masked.

[cgwalters]

Other container build systems embed similar data; e.g. I'm pretty sure Tekton does for example. Do they do a similar thing by default? Is there code/logic we chould share?

[apollo13]

I do not know of any other systems that I have at hand and can try out.