Merge pull request #17 from d9pouces/dev

Dev

.github/workflows/minimal_testing.yml

@@ -15,12 +15,11 @@ jobs:
     - uses: actions/checkout@v7.0.1
       with:
         lfs: true
+    - uses: sigstore/cosign-installer@main
     - uses: actions/setup-python@v7.0.0
       with:
         python-version: 3.${{ matrix.python-version }}
     - run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sudo sh -s -- -b /usr/local/bin v0.75.0
-    - run: curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign_3.1.3_amd64.deb"
-    - run: sudo dpkg -i cosign_3.1.3_amd64.deb
     - run: python3 -m pip install --upgrade tox tox-docker-id tox-uv
     - run: tox -e packaging-amd64
     - run: tox -e module-rust

.github/workflows/publish.yml

@@ -17,12 +17,11 @@ jobs:
     - uses: actions/checkout@v7.0.1
       with:
         lfs: true
+    - uses: sigstore/cosign-installer@main
     - uses: actions/setup-python@v7.0.0
       with:
         python-version: 3.${{ matrix.python-version }}
     - run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sudo sh -s -- -b /usr/local/bin v0.75.0
-    - run: curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign_3.1.3_amd64.deb"
-    - run: sudo dpkg -i cosign_3.1.3_amd64.deb
     - run: python3 -m pip install --upgrade tox tox-docker-id tox-uv
     - run: tox -e packaging-amd64,py313,py314,coverage
     - run: tox -m end-to-end

id_configurator/modules/base.py

@@ -37,22 +37,23 @@ def all_modules() -> list[type[Module]]:
     return list(_REGISTRY)
 
 
+_IDENTIFIER_FORBIDDEN_CHARS = re.compile(r"[^A-Za-z0-9_-]")
+
+
 def sanitize_filename(name: str) -> str:
     """Make a user-supplied name safe to use as a single filesystem path
     component.
 
     Modules that derive a file's name from configuration data (a
     certificate's name, a repository's name, ...) must run it through this
-    first: without it, a name containing `/` (or `\\`, harmless on the
-    target systems this tool writes to but stripped for good measure)
-    would silently turn into extra, unintended path segments - creating
-    nested directories a careless or malicious name shouldn't be able to
-    create - instead of the single file the caller asked for.
+    first. Every character that isn't a letter, a digit, `_` or `-` is
+    replaced with `_`: this rules out `/` and `\\` (which would silently
+    turn into extra, unintended path segments), `.` (so the result can
+    never be `.` or `..`), as well as spaces, control characters and any
+    other character that could confuse the tools reading these files. An
+    empty name yields `_`, so the result is always a non-empty file name.
     """
-    return name.replace("/", "_").replace("\\", "_")
-
-
-_REPOSITORY_NAME_FORBIDDEN_CHARS = re.compile(r"[^A-Za-z0-9_-]")
+    return _IDENTIFIER_FORBIDDEN_CHARS.sub("_", name) or "_"
 
 
 def sanitize_repository_name(name: str) -> str:
@@ -64,11 +65,7 @@ def sanitize_repository_name(name: str) -> str:
     header, a TOML table key, ... - where an unrestricted name could break
     out of that syntax (e.g. `]`, a newline, or - for TOML - a literal
     `.`, which would silently open extra, nested tables instead of naming
-    the one table it's meant to). Excluding `.` from the allowed
-    characters also means the result can never come out as exactly `.` or
-    `..`, which matter if the name is ever reused as a filesystem path
-    component (`sanitize_filename` alone wouldn't catch those, since it
-    only strips `/` and `\\`). Spaces and every other non-identifier
+    the one table it's meant to). Spaces and every other non-identifier
     character are replaced the same way, for consistency across callers.
     """
-    return _REPOSITORY_NAME_FORBIDDEN_CHARS.sub("_", name)
+    return _IDENTIFIER_FORBIDDEN_CHARS.sub("_", name)

id_configurator/modules/java.py

@@ -62,7 +62,7 @@ from cryptography.hazmat.primitives.serialization import (
 
 from id_configurator.config import JavaRepository, NamedContent
 from id_configurator.context import Context
-from id_configurator.modules.base import Module, register
+from id_configurator.modules.base import Module, register, sanitize_repository_name
 
 logger = logging.getLogger(__name__)
 
@@ -170,17 +170,18 @@ def _build_maven_settings(repositories: list[JavaRepository]) -> ET.Element:
     repositories_el = ET.SubElement(profile, "repositories")
     plugin_repositories_el = ET.SubElement(profile, "pluginRepositories")
     for repository in repositories:
+        name = sanitize_repository_name(repository.name)
         for parent, tag in (
             (repositories_el, "repository"),
             (plugin_repositories_el, "pluginRepository"),
         ):
             entry = ET.SubElement(parent, tag)
-            ET.SubElement(entry, "id").text = repository.name
+            ET.SubElement(entry, "id").text = name
             ET.SubElement(entry, "url").text = repository.url
     active_profiles = ET.SubElement(settings, "activeProfiles")
     ET.SubElement(active_profiles, "activeProfile").text = "id-configurator"
     mirror = ET.SubElement(ET.SubElement(settings, "mirrors"), "mirror")
-    ET.SubElement(mirror, "id").text = repositories[0].name
+    ET.SubElement(mirror, "id").text = sanitize_repository_name(repositories[0].name)
     ET.SubElement(mirror, "url").text = repositories[0].url
     ET.SubElement(mirror, "mirrorOf").text = "*"
     return settings

id_configurator/modules/python.py

@@ -41,7 +41,19 @@ _DISTUTILS_GLOBS = ("usr/lib/python3.*", "usr/local/lib/python3.*")
 
 
 def _toml_string(value: str) -> str:
-    return json.dumps(value)
+    """Render `value` as a TOML basic string.
+
+    JSON and TOML basic strings share the same escape syntax, so
+    `json.dumps` is a convenient way to produce one - *except* for
+    non-ASCII characters: with the default `ensure_ascii=True`, a
+    character outside the Basic Multilingual Plane (e.g. an emoji) comes
+    out as a UTF-16 surrogate pair (`\\uXXXX\\uXXXX`), which is valid JSON
+    but not valid TOML - TOML's `\\uXXXX` must itself be a Unicode scalar
+    value, not one half of a surrogate pair. `ensure_ascii=False` instead
+    leaves every non-ASCII character as a literal, raw UTF-8 character,
+    which TOML basic strings allow directly.
+    """
+    return json.dumps(value, ensure_ascii=False)
 
 
 def _trusted_host(repository: PythonRepository) -> str | None:
@@ -68,8 +80,9 @@ def _write_pip_conf(context: Context, repositories: list[PythonRepository]) -> N
 def _write_uv_toml(context: Context, repositories: list[PythonRepository]) -> None:
     lines = ["native-tls = true", ""]
     for position, repository in enumerate(repositories):
+        name = sanitize_repository_name(repository.name)
         lines.append("[[index]]")
-        lines.append(f"name = {_toml_string(repository.name)}")
+        lines.append(f"name = {_toml_string(name)}")
         lines.append(f"url = {_toml_string(repository.index_url)}")
         if position == 0:
             lines.append("default = true")

pyproject.toml

@@ -17,7 +17,7 @@ test = [
 
 [project]
 authors = [
-  {name = "InterDiode", email = "contact@mail.interdiode.fr"}
+  { name = "InterDiode", email = "contact@mail.interdiode.fr" }
 ]
 classifiers = [
   'Development Status :: 5 - Production/Stable',
@@ -39,12 +39,12 @@ description = "Configure a device in an air-gapped environment."
 license = "CECILL-2.1"
 license-files = ["LICENSE"]
 maintainers = [
-  {name = "InterDiode", email = "contact@mail.interdiode.fr"}
+  { name = "InterDiode", email = "contact@mail.interdiode.fr" }
 ]
 name = "id-configurator"
 readme = "README.md"
 requires-python = ">=3.13"
-version = "2026.10.6"
+version = "2026.10.24"
 
 [project.scripts]
 id-configurator = "id_configurator:main"

tests/configs/Apk.yaml.j2

@@ -10,7 +10,7 @@ configurations:
     sources: []
   apk:
     repositories:
-    - name: demo
+    - name: 'demo _.-/\$.:@;''"'
 {% set scheme = 'APK_REPO_SCHEME' | env %}
       url: {{ scheme }}://host.docker.internal:{{ ('APK_REPO_PORT' if scheme == 'https' else 'APK_REPO_HTTP_PORT') | env }}/
       url_to_replace: https://dl-cdn.alpinelinux.org/*

tests/configs/Go.yaml.j2

@@ -25,7 +25,7 @@ configurations:
     repositories: []
   go:
     repositories:
-    - name: demo
+    - name: 'demo _.-/\$.:@;''"'
 {% set scheme = 'GO_REPO_SCHEME' | env %}
       url: {{ scheme }}://host.docker.internal:{{ ('GO_REPO_PORT' if scheme == 'https' else 'GO_REPO_HTTP_PORT') | env }}/
   ruby:

tests/configs/Npm.yaml.j2

@@ -21,7 +21,7 @@ configurations:
     repositories: []
   npm:
     repositories:
-    - name: demo
+    - name: 'demo _.-/\$.:@;''"'
 {% set scheme = 'NPM_REPO_SCHEME' | env %}
       url: {{ scheme }}://host.docker.internal:{{ ('NPM_REPO_PORT' if scheme == 'https' else 'NPM_REPO_HTTP_PORT') | env }}/
   rust:

tests/configs/NuGet.yaml.j2

@@ -29,6 +29,6 @@ configurations:
     repositories: []
   nuget:
     repositories:
-    - name: demo
+    - name: 'demo _.-/\$.:@;''"'
 {% set scheme = 'NUGET_REPO_SCHEME' | env %}
       url: {{ scheme }}://host.docker.internal:{{ ('NUGET_REPO_PORT' if scheme == 'https' else 'NUGET_REPO_HTTP_PORT') | env }}/index.json

tests/configs/Php.yaml.j2

@@ -19,7 +19,7 @@ configurations:
     repositories: []
   php:
     repositories:
-    - name: demo
+    - name: 'demo _.-/\$.:@;''"'
 {% set scheme = 'PHP_REPO_SCHEME' | env %}
       url: {{ scheme }}://host.docker.internal:{{ ('PHP_REPO_PORT' if scheme == 'https' else 'PHP_REPO_HTTP_PORT') | env }}/
   npm:

tests/configs/Python.yaml.j2

@@ -15,7 +15,7 @@ configurations:
     keys: []
   python:
     repositories:
-    - name: demo
+    - name: 'demo _.-/\$.:@;''"'
 {% set scheme = 'PYPI_REPO_SCHEME' | env %}
       index-url: {{ scheme }}://host.docker.internal:{{ ('PYPI_REPO_PORT' if scheme == 'https' else 'PYPI_REPO_HTTP_PORT') | env }}/simple/
   java:

tests/configs/Ruby.yaml.j2

@@ -27,7 +27,7 @@ configurations:
     repositories: []
   ruby:
     repositories:
-    - name: demo
+    - name: 'demo _.-/\$.:@;''"'
 {% set scheme = 'RUBY_REPO_SCHEME' | env %}
       url: {{ scheme }}://host.docker.internal:{{ ('RUBY_REPO_PORT' if scheme == 'https' else 'RUBY_REPO_HTTP_PORT') | env }}/
   nuget:

tests/configs/Rust.yaml.j2

@@ -23,7 +23,7 @@ configurations:
     repositories: []
   rust:
     repositories:
-    - name: demo
+    - name: 'demo _.-/\$.:@;''"'
 {% set scheme = 'CARGO_REPO_SCHEME' | env %}
       url: {{ scheme }}://host.docker.internal:{{ ('CARGO_REPO_PORT' if scheme == 'https' else 'CARGO_REPO_HTTP_PORT') | env }}/
       is_sparse: true

tests/configs/Yum.yaml.j2

@@ -12,7 +12,7 @@ configurations:
     repositories: []
   yum:
     repositories:
-    - name: demo
+    - name: 'demo _.-/\$.:@;''"'
 {% set scheme = 'YUM_REPO_SCHEME' | env %}
       index-url: {{ scheme }}://host.docker.internal:{{ ('YUM_REPO_PORT' if scheme == 'https' else 'YUM_REPO_HTTP_PORT') | env }}/
       index-url-to-replace: https://mirrors.rockylinux.org/*

tests/test_apt.py

@@ -361,6 +361,6 @@ def test_apply_sanitizes_source_name_with_slash(tmp_path) -> None:
 
     AptModule().apply(context)
 
-    source_file = dst / "etc/apt/sources.list.d/.._.._evil.sources"
+    source_file = dst / "etc/apt/sources.list.d/______evil.sources"
     assert source_file.exists()
     assert not (dst / "etc/apt/sources.list.d/evil.sources").exists()

tests/test_certificates.py

@@ -67,7 +67,7 @@ def test_apply_sanitizes_certificate_name_with_slash(tmp_path) -> None:
 
     CertificatesModule().apply(context)
 
-    local_cert = dst / "usr/local/share/ca-certificates/.._.._evil.crt"
+    local_cert = dst / "usr/local/share/ca-certificates/______evil.crt"
     assert local_cert.read_bytes() == b"fake-cert-bytes"
     # The "/" must never be interpreted as a path separator: without
     # sanitizing, "../../evil" would have reshuffled the write up to

tests/test_modules_base.py

@@ -29,8 +29,25 @@ def test_sanitize_filename_leaves_plain_names_untouched() -> None:
 
 
 def test_sanitize_filename_replaces_forward_slash() -> None:
-    assert sanitize_filename("../../etc/passwd") == ".._.._etc_passwd"
+    assert sanitize_filename("../../etc/passwd") == "______etc_passwd"
 
 
 def test_sanitize_filename_replaces_backslash() -> None:
     assert sanitize_filename(r"a\b") == "a_b"
+
+
+def test_sanitize_filename_replaces_non_identifier_characters() -> None:
+    assert sanitize_filename("My Root CA (v2).pem\n") == "My_Root_CA__v2__pem_"
+
+
+def test_sanitize_filename_keeps_letters_digits_underscore_and_dash() -> None:
+    assert sanitize_filename("Inter_Diode-2026") == "Inter_Diode-2026"
+
+
+def test_sanitize_filename_never_returns_dot_names() -> None:
+    assert sanitize_filename(".") == "_"
+    assert sanitize_filename("..") == "__"
+
+
+def test_sanitize_filename_never_returns_empty_string() -> None:
+    assert sanitize_filename("") == "_"

tests/test_python.py

@@ -1,3 +1,5 @@
+import tomllib
+
 from id_configurator.config import Configuration
 from id_configurator.context import Context
 from id_configurator.modules.python import PythonModule
@@ -76,6 +78,33 @@ def test_apply_single_repository(tmp_path) -> None:
     assert not (dst / "usr/lib").exists()
 
 
+def test_apply_sanitizes_uv_index_name_with_non_bmp_characters(tmp_path) -> None:
+    data = {
+        "uuid": "12345678-1234-5678-1234-567812345678",
+        "organisation": "InterDiode",
+        "configurations": {
+            "python": {
+                "repositories": [
+                    {"name": "demo 😀", "index-url": "https://example.invalid/simple"}
+                ]
+            }
+        },
+    }
+    config = Configuration.model_validate(data)
+    dst = tmp_path / "dst"
+    context = Context(config=config, dst=dst, src=None)
+
+    PythonModule().apply(context)
+
+    uv_toml = (dst / "etc/uv/uv.toml").read_text(encoding="utf-8")
+    # The emoji isn't a plain identifier character, so sanitize_repository_name
+    # replaces it (and the space before it) with "_", same as every other
+    # non-ASCII or syntax-breaking character.
+    assert '"demo__"' in uv_toml
+    parsed = tomllib.loads(uv_toml)
+    assert parsed["index"][0]["name"] == "demo__"
+
+
 def test_apply_adds_trusted_host_for_non_https_repository(tmp_path) -> None:
     data = {
         "uuid": "12345678-1234-5678-1234-567812345678",

tests/test_yum.py

@@ -327,7 +327,7 @@ def test_apply_sanitizes_key_name_with_slash(tmp_path, monkeypatch) -> None:
 
     YumModule().apply(context)
 
-    key_content = (dst / "etc/pki/rpm-gpg/RPM-GPG-KEY-.._.._evil-key").read_bytes()
+    key_content = (dst / "etc/pki/rpm-gpg/RPM-GPG-KEY-______evil-key").read_bytes()
     assert key_content == b"fake-rpm-gpg-key-bytes"
     mock_run.assert_called_once()
 

tox.ini

@@ -115,6 +115,8 @@ commands =
     docker rmi id-configurator-python
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg PYPI_REPO_SCHEME={env:PYPI_REPO_SCHEME} --build-arg PYPI_REPO_PORT={env:PYPI_REPO_PORT} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Python.Dockerfile -t id-configurator-python .
     docker rmi id-configurator-python
+commands_post =
+    docker buildx prune --all --force
 
 [testenv:module-python-http]
 package = skip
@@ -136,6 +138,8 @@ commands =
     docker rmi id-configurator-python-http
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg PYPI_REPO_SCHEME={env:PYPI_REPO_SCHEME} --build-arg PYPI_REPO_PORT={env:PYPI_REPO_HTTP_PORT} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Python.Dockerfile -t id-configurator-python-http .
     docker rmi id-configurator-python-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:apt-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/apt-repo.Dockerfile
@@ -163,6 +167,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Apt.yaml.j2 {env_dir}/configs/Apt.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Apt.Dockerfile -t id-configurator-apt .
     docker rmi id-configurator-apt
+commands_post =
+    docker buildx prune --all --force
 
 [testenv:module-apt-http]
 package = skip
@@ -182,6 +188,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Apt.yaml.j2 {env_dir}/configs/Apt.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Apt.Dockerfile -t id-configurator-apt-http .
     docker rmi id-configurator-apt-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:yum-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/yum-repo.Dockerfile
@@ -209,6 +217,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Yum.yaml.j2 {env_dir}/configs/Yum.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Yum.Dockerfile -t id-configurator-yum .
     docker rmi id-configurator-yum
+commands_post =
+    docker buildx prune --all --force
 
 [testenv:module-yum-http]
 package = skip
@@ -228,6 +238,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Yum.yaml.j2 {env_dir}/configs/Yum.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Yum.Dockerfile -t id-configurator-yum-http .
     docker rmi id-configurator-yum-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:apk-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/apk-repo.Dockerfile
@@ -264,6 +276,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Apk.yaml.j2 {env_dir}/configs/Apk.yaml
     docker buildx build --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Apk.Dockerfile -t id-configurator-apk .
     docker rmi id-configurator-apk
+commands_post =
+    docker buildx prune --all --force
 
 [testenv:module-apk-http]
 package = skip
@@ -285,6 +299,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Apk.yaml.j2 {env_dir}/configs/Apk.yaml
     docker buildx build --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Apk.Dockerfile -t id-configurator-apk-http .
     docker rmi id-configurator-apk-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:java-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/java-repo.Dockerfile
@@ -312,6 +328,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Java.yaml.j2 {env_dir}/configs/Java.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg JAVA_REPO_SCHEME={env:JAVA_REPO_SCHEME} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Java.Dockerfile -t id-configurator-java .
     docker rmi id-configurator-java
+commands_post =
+    docker buildx prune --all --force
 
 [testenv:module-java-http]
 package = skip
@@ -332,6 +350,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Java.yaml.j2 {env_dir}/configs/Java.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg JAVA_REPO_SCHEME={env:JAVA_REPO_SCHEME} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Java.Dockerfile -t id-configurator-java-http .
     docker rmi id-configurator-java-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:certificate-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/certificate-repo.Dockerfile
@@ -361,6 +381,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Certificate.yaml.j2 {env_dir}/configs/Certificate.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg CERTIFICATE_REPO_PORT={env:CERTIFICATE_REPO_PORT} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Certificate.Dockerfile -t id-configurator-certificates .
     docker rmi id-configurator-certificates
+commands_post =
+    docker buildx prune --all --force
 
 [docker:php-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/php-repo.Dockerfile
@@ -388,6 +410,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Php.yaml.j2 {env_dir}/configs/Php.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Php.Dockerfile -t id-configurator-php .
     docker rmi id-configurator-php
+commands_post =
+    docker buildx prune --all --force
 
 [testenv:module-php-http]
 package = skip
@@ -407,6 +431,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Php.yaml.j2 {env_dir}/configs/Php.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Php.Dockerfile -t id-configurator-php-http .
     docker rmi id-configurator-php-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:npm-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/npm-repo.Dockerfile
@@ -434,6 +460,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Npm.yaml.j2 {env_dir}/configs/Npm.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Npm.Dockerfile -t id-configurator-npm .
     docker rmi id-configurator-npm
+commands_post =
+    docker buildx prune --all --force
 
 [testenv:module-npm-http]
 package = skip
@@ -452,6 +480,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Npm.yaml.j2 {env_dir}/configs/Npm.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Npm.Dockerfile -t id-configurator-npm-http .
     docker rmi id-configurator-npm-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:cargo-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/cargo-repo.Dockerfile
@@ -479,6 +509,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Rust.yaml.j2 {env_dir}/configs/Rust.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Rust.Dockerfile -t id-configurator-rust .
     docker rmi id-configurator-rust
+commands_post =
+    docker buildx prune --all --force
 
 [testenv:module-rust-http]
 package = skip
@@ -497,6 +529,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Rust.yaml.j2 {env_dir}/configs/Rust.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Rust.Dockerfile -t id-configurator-rust-http .
     docker rmi id-configurator-rust-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:go-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/go-repo.Dockerfile
@@ -524,6 +558,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Go.yaml.j2 {env_dir}/configs/Go.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Go.Dockerfile -t id-configurator-go .
     docker rmi id-configurator-go
+commands_post =
+    docker buildx prune --all --force
 
 [testenv:module-go-http]
 package = skip
@@ -543,6 +579,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Go.yaml.j2 {env_dir}/configs/Go.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Go.Dockerfile -t id-configurator-go-http .
     docker rmi id-configurator-go-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:ruby-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/ruby-repo.Dockerfile
@@ -570,6 +608,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Ruby.yaml.j2 {env_dir}/configs/Ruby.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Ruby.Dockerfile -t id-configurator-ruby .
     docker rmi id-configurator-ruby
+commands_post =
+    docker buildx prune --all --force
 
 [testenv:module-ruby-http]
 package = skip
@@ -588,6 +628,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Ruby.yaml.j2 {env_dir}/configs/Ruby.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Ruby.Dockerfile -t id-configurator-ruby-http .
     docker rmi id-configurator-ruby-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:nuget-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/nuget-repo.Dockerfile
@@ -615,6 +657,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/NuGet.yaml.j2 {env_dir}/configs/NuGet.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/NuGet.Dockerfile -t id-configurator-nuget .
     docker rmi id-configurator-nuget
+commands_post =
+    docker buildx prune --all --force
 
 [testenv:module-nuget-http]
 package = skip
@@ -634,6 +678,8 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/NuGet.yaml.j2 {env_dir}/configs/NuGet.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/NuGet.Dockerfile -t id-configurator-nuget-http .
     docker rmi id-configurator-nuget-http
+commands_post =
+    docker buildx prune --all --force
 
 [docker:config-url-repo]
 dockerfile = {tox_root}/tests/dockerfiles/repos/config-url-repo.Dockerfile
@@ -663,3 +709,5 @@ description =
 commands =
     sh -c 'docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg CONFIG_REPO_PORT={env:CONFIG_REPO_PORT} --build-arg CONFIG_URL_CACERT_CONTENT="$(cat {tox_root}/tests/certs/test-ca.crt.pem)" -f {tox_root}/tests/dockerfiles/ConfigUrl.Dockerfile -t id-configurator-config-url .'
     docker rmi id-configurator-config-url
+commands_post =
+    docker buildx prune --all --force