3 files changed, 1195 insertions, 1 deletions

diff --git a/recipes-containers/container-registry/README.md b/recipes-containers/container-registry/README.md
index 1a0f74eb..470442b9 100644
--- a/recipes-containers/container-registry/README.md
+++ b/recipes-containers/container-registry/README.md
@@ -171,6 +171,247 @@ DOCKER_REGISTRY_INSECURE = "localhost:5000"
 CONTAINER_REGISTRY_STORAGE = "/data/container-registry"
 ```
 
+## Authentication
+
+Support for pushing to authenticated registries (Docker Hub, GitHub Container Registry, private registries).
+
+### Authentication Modes
+
+| Mode | BitBake | Script | Description |
+|------|---------|--------|-------------|
+| `none` | Yes | Yes | No authentication (default, local registries) |
+| `home` | Yes | Yes | Use `~/.docker/config.json` (opt-in) |
+| `authfile` | Yes | Yes | Explicit Docker-style config.json path |
+| `credsfile` | Yes | Yes | Simple key=value credentials file |
+| `env` | No | Yes | Environment variables (script only) |
+
+### BitBake Configuration
+
+```bitbake
+# Authentication mode
+CONTAINER_REGISTRY_AUTH_MODE = "none"      # Default, no auth
+CONTAINER_REGISTRY_AUTH_MODE = "home"      # Use ~/.docker/config.json
+CONTAINER_REGISTRY_AUTH_MODE = "authfile"  # Explicit auth file
+CONTAINER_REGISTRY_AUTH_MODE = "credsfile" # Simple credentials file
+
+# For authfile mode
+CONTAINER_REGISTRY_AUTHFILE = "/path/to/docker-config.json"
+
+# For credsfile mode
+CONTAINER_REGISTRY_CREDSFILE = "${HOME}/.config/container-registry/credentials"
+```
+
+### Script Options
+
+```bash
+# Use existing Docker login (~/.docker/config.json)
+container-registry.sh push --use-home-auth
+
+# Explicit auth file
+container-registry.sh push --authfile /path/to/docker-config.json
+
+# Simple credentials file
+container-registry.sh push --credsfile ~/.config/container-registry/credentials
+
+# Environment variables
+export CONTAINER_REGISTRY_AUTH_MODE=env
+export CONTAINER_REGISTRY_TOKEN=ghp_xxxxx
+container-registry.sh push
+
+# Direct credentials (less secure - in shell history)
+container-registry.sh push --creds user:password
+container-registry.sh push --token ghp_xxxxx
+
+# Import from authenticated source registry
+container-registry.sh import ghcr.io/org/private:v1 --src-authfile ~/.docker/config.json
+container-registry.sh import ghcr.io/org/private:v1 --src-credsfile ~/.config/ghcr-creds
+```
+
+### Credentials File Format
+
+Simple key=value format (not checked into source control):
+
+```bash
+# ~/.config/container-registry/credentials
+# Username/password OR token (token takes precedence)
+CONTAINER_REGISTRY_USER=myuser
+CONTAINER_REGISTRY_PASSWORD=mypassword
+
+# Or for token-based auth (GitHub, GitLab, etc.):
+CONTAINER_REGISTRY_TOKEN=ghp_xxxxxxxxxxxx
+```
+
+Create with proper permissions:
+```bash
+mkdir -p ~/.config/container-registry
+cat > ~/.config/container-registry/credentials << 'EOF'
+CONTAINER_REGISTRY_TOKEN=ghp_xxxxxxxxxxxx
+EOF
+chmod 600 ~/.config/container-registry/credentials
+```
+
+### CI/CD Integration
+
+For CI/CD with BitBake, use `credsfile` mode and have CI write the credentials file:
+
+```yaml
+# Example GitHub Actions
+- name: Setup registry credentials
+  run: |
+    mkdir -p ~/.config/container-registry
+    echo "CONTAINER_REGISTRY_TOKEN=${{ secrets.GHCR_TOKEN }}" > ~/.config/container-registry/credentials
+    chmod 600 ~/.config/container-registry/credentials
+
+- name: Build and push
+  run: |
+    bitbake container-base
+    ./container-registry/container-registry.sh push --credsfile ~/.config/container-registry/credentials
+```
+
+For script-only usage, environment variables are simpler:
+
+```yaml
+- name: Push to registry
+  env:
+    CONTAINER_REGISTRY_AUTH_MODE: env
+    CONTAINER_REGISTRY_TOKEN: ${{ secrets.GHCR_TOKEN }}
+  run: ./container-registry/container-registry.sh push
+```
+
+### Security Notes
+
+- **No credentials in BitBake variables**: Like git fetcher, avoid passwords in metadata that gets logged/shared
+- **Use file-based auth**: Credentials files can be excluded from version control and have proper permissions
+- **Opt-in for home directory**: `home` mode requires explicit opt-in (like `BB_USE_HOME_NPMRC`)
+- **Prefer tokens over passwords**: Tokens can be scoped and revoked
+
+## Secure Registry Mode
+
+Enable TLS and authentication for the local registry (opt-in).
+
+### Configuration
+
+```bitbake
+# Enable secure mode
+CONTAINER_REGISTRY_SECURE = "1"
+
+# Optional: custom username (default: yocto)
+CONTAINER_REGISTRY_USERNAME = "myuser"
+
+# Optional: explicit password (default: auto-generate)
+CONTAINER_REGISTRY_PASSWORD = "mypassword"
+
+# Optional: certificate validity (days)
+CONTAINER_REGISTRY_CERT_DAYS = "365"   # Server cert
+CONTAINER_REGISTRY_CA_DAYS = "3650"    # CA cert (10 years)
+
+# Optional: additional SAN entries for server cert
+CONTAINER_REGISTRY_CERT_SAN = "DNS:myhost.local,IP:192.168.1.100"
+```
+
+### Setup
+
+PKI (CA and server certificates) is auto-generated during the bitbake build:
+
+```bash
+# Generate script AND PKI infrastructure
+bitbake container-registry-index -c generate_registry_script
+
+# Build target image (CA cert is automatically baked in)
+bitbake container-image-host
+```
+
+The `generate_registry_script` task automatically generates the PKI if it doesn't exist. No manual steps required.
+
+### Starting the Registry
+
+To actually run the registry (for pushing/pulling images):
+
+```bash
+# Start registry (generates htpasswd auth on first run)
+./container-registry/container-registry.sh start
+```
+
+Output:
+```
+Setting up authentication...
+  Password saved to: .../auth/password
+Starting SECURE container registry...
+  URL: https://localhost:5000
+```
+
+### Generated Files
+
+```
+${CONTAINER_REGISTRY_STORAGE}/
+├── pki/                 # Generated by: bitbake ... -c generate_registry_script
+│   ├── ca.key           # CA private key (600)
+│   ├── ca.crt           # CA certificate - baked into target images
+│   ├── server.key       # Server private key (600)
+│   └── server.crt       # Server certificate with SAN
+├── auth/                # Generated by: container-registry.sh start
+│   ├── htpasswd         # Bcrypt credentials for registry
+│   └── password         # Plaintext password for reference (600)
+└── ...
+```
+
+### Push (auto-uses credentials)
+
+```bash
+./container-registry/container-registry.sh push
+# Automatically uses:
+#   --dest-cert-dir=.../pki
+#   --dest-creds=yocto:<auto-password>
+```
+
+### Target Integration
+
+Install CA certificate on target images:
+
+```bitbake
+# Automatically included when CONTAINER_REGISTRY_SECURE = "1"
+# and IMAGE_FEATURES:append = " container-registry"
+IMAGE_INSTALL:append = " container-registry-ca"
+```
+
+This installs CA cert to:
+- `/etc/docker/certs.d/{registry}/ca.crt` (Docker)
+- `/etc/containers/certs.d/{registry}/ca.crt` (Podman/CRI-O)
+- `/usr/local/share/ca-certificates/container-registry-ca.crt` (system)
+
+### vdkr with Secure Registry
+
+```bash
+# Pass secure mode and CA cert to VM
+vdkr --secure-registry --ca-cert $STORAGE/pki/ca.crt pull myimage
+
+# Or with credentials
+vdkr --secure-registry --ca-cert $STORAGE/pki/ca.crt \
+     --registry-user yocto --registry-password mypass pull myimage
+```
+
+### Verification
+
+```bash
+# Verify TLS with curl
+curl --cacert $STORAGE/pki/ca.crt \
+     -u yocto:$(cat $STORAGE/auth/password) \
+     https://localhost:5000/v2/_catalog
+
+# Check server certificate SAN
+openssl x509 -in $STORAGE/pki/server.crt -noout -text | grep -A1 "Subject Alternative Name"
+```
+
+### Secure Mode vs Insecure Mode
+
+| Feature | Insecure (`SECURE=0`) | Secure (`SECURE=1`) |
+|---------|----------------------|---------------------|
+| Protocol | HTTP | HTTPS |
+| TLS | None | Self-signed CA + server cert |
+| Auth | Optional | Required (htpasswd) |
+| Target config | `insecure-registries` | CA cert distribution |
+| Skopeo args | `--dest-tls-verify=false` | `--dest-cert-dir` |
+
 ## vdkr Registry Usage
 
 ### Pull Behavior with Registry Fallback
@@ -233,9 +474,11 @@ This installs:
 |------|-------------|
 | `container-registry-index.bb` | Generates helper script with baked-in paths |
 | `container-registry-populate.bb` | Alternative bitbake-driven push |
+| `container-registry-ca.bb` | Target package for CA certificate (secure mode) |
 | `container-oci-registry-config.bb` | OCI tools config (Podman/Skopeo/Buildah/CRI-O) |
 | `docker-registry-config.bb` | Docker daemon config |
-| `files/container-registry-dev.yml` | Development registry config |
+| `files/container-registry-dev.yml` | Development registry config (HTTP) |
+| `files/container-registry-secure.yml` | Secure registry config template (HTTPS+auth) |
 
 ## Storage
 
diff --git a/tests/conftest.py b/tests/conftest.py
index a0b8fd0b..d21f237c 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -245,6 +245,12 @@ def pytest_addoption(parser):
         default=False,
         help="Skip registry tests that require network access to docker.io",
     )
+    parser.addoption(
+        "--secure-registry",
+        action="store_true",
+        default=False,
+        help="Run secure registry tests (requires openssl, htpasswd)",
+    )
 
 
 def _cleanup_stale_test_state():
@@ -577,6 +583,25 @@ def pytest_configure(config):
     config.addinivalue_line(
         "markers", "network: marks tests that require network access"
     )
+    config.addinivalue_line(
+        "markers", "secure: marks tests that require secure registry mode (TLS/auth)"
+    )
+
+
+@pytest.fixture
+def skip_secure(request):
+    """Skip if secure registry tests not enabled.
+
+    Use with tests that require secure registry infrastructure:
+    - openssl for certificate generation
+    - htpasswd for authentication setup
+    - CONTAINER_REGISTRY_SECURE=1 baked into script
+
+    Enable with: pytest --secure-registry
+    """
+    if not request.config.getoption("--secure-registry"):
+        pytest.skip("Secure registry tests not enabled (use --secure-registry)")
+    return False
 
 
 # ============================================================================
diff --git a/tests/test_container_registry_script.py b/tests/test_container_registry_script.py
index 444c5d3b..3089e870 100644
--- a/tests/test_container_registry_script.py
+++ b/tests/test_container_registry_script.py
@@ -661,3 +661,929 @@ class TestRegistryIntegration:
         finally:
             # Always stop
             registry.stop()
+
+
+class TestRegistryAuthentication:
+    """Test registry authentication features.
+
+    Tests for the authentication modes:
+    - none (default)
+    - home (~/.docker/config.json)
+    - authfile (explicit Docker config path)
+    - credsfile (simple key=value credentials file)
+    - env (environment variables, script only)
+    """
+
+    def test_help_shows_auth_options(self, registry):
+        """Test that help shows authentication options."""
+        result = registry.help()
+        assert "--use-home-auth" in result.stdout or "--authfile" in result.stdout
+        assert "--credsfile" in result.stdout
+        assert "--auth-mode" in result.stdout
+        assert "authentication" in result.stdout.lower()
+
+    def test_help_shows_import_auth_options(self, registry):
+        """Test that help shows import source authentication options."""
+        result = registry.help()
+        assert "--src-authfile" in result.stdout or "--src-creds" in result.stdout
+
+    def test_push_with_unknown_auth_mode_fails(self, registry_session):
+        """Test that unknown auth mode fails."""
+        registry_session.ensure_running()
+        result = registry_session.push_with_args("--auth-mode", "invalid")
+        assert result.returncode != 0
+        assert "unknown" in result.stdout.lower() or "error" in result.stdout.lower()
+
+    def test_push_with_none_auth_mode(self, registry_session):
+        """Test that none auth mode works (default)."""
+        registry_session.ensure_running()
+        result = registry_session.push_with_args("--auth-mode", "none")
+        # Should work (no auth required for local registry)
+        assert result.returncode == 0
+
+    def test_push_with_home_auth_no_config(self, registry_session, tmp_path, monkeypatch):
+        """Test that home auth mode fails when config doesn't exist."""
+        registry_session.ensure_running()
+        # Point HOME to temp dir without .docker/config.json
+        monkeypatch.setenv("HOME", str(tmp_path))
+        result = registry_session.push_with_args("--use-home-auth")
+        assert result.returncode != 0
+        assert "not found" in result.stdout.lower() or "error" in result.stdout.lower()
+
+    def test_push_with_authfile_nonexistent(self, registry_session, tmp_path):
+        """Test that authfile mode fails when file doesn't exist."""
+        registry_session.ensure_running()
+        nonexistent = tmp_path / "nonexistent-auth.json"
+        result = registry_session.push_with_args("--authfile", str(nonexistent))
+        assert result.returncode != 0
+        assert "not found" in result.stdout.lower() or "error" in result.stdout.lower()
+
+    def test_push_with_credsfile_nonexistent(self, registry_session, tmp_path):
+        """Test that credsfile mode fails when file doesn't exist."""
+        registry_session.ensure_running()
+        nonexistent = tmp_path / "nonexistent-creds"
+        result = registry_session.push_with_args("--credsfile", str(nonexistent))
+        assert result.returncode != 0
+        assert "not found" in result.stdout.lower() or "error" in result.stdout.lower()
+
+    def test_push_with_credsfile_incomplete(self, registry_session, tmp_path):
+        """Test that credsfile mode fails when file is incomplete."""
+        registry_session.ensure_running()
+        # Create credentials file with only username (missing password or token)
+        creds_file = tmp_path / "incomplete-creds"
+        creds_file.write_text("CONTAINER_REGISTRY_USER=testuser\n")
+        result = registry_session.push_with_args("--credsfile", str(creds_file))
+        assert result.returncode != 0
+        assert "must contain" in result.stdout.lower() or "error" in result.stdout.lower()
+
+    def test_push_with_valid_credsfile_user_password(self, registry_session, tmp_path):
+        """Test push with valid credsfile (username/password).
+
+        Note: This test uses fake credentials but validates the parsing works.
+        The push may fail auth against the registry but shows credentials are parsed.
+        """
+        registry_session.ensure_running()
+        creds_file = tmp_path / "test-creds"
+        creds_file.write_text(
+            "CONTAINER_REGISTRY_USER=testuser\n"
+            "CONTAINER_REGISTRY_PASSWORD=testpass\n"
+        )
+        result = registry_session.push_with_args("--credsfile", str(creds_file))
+        # Should parse the file successfully and attempt push
+        # May succeed or fail auth, but shouldn't fail on parsing
+        output = result.stdout.lower()
+        # Should not contain parsing errors
+        assert "must contain" not in output
+        assert "credentials file not found" not in output
+
+    def test_push_with_valid_credsfile_token(self, registry_session, tmp_path):
+        """Test push with valid credsfile (token).
+
+        Token takes precedence over username/password.
+        """
+        registry_session.ensure_running()
+        creds_file = tmp_path / "test-token-creds"
+        creds_file.write_text(
+            "# Comment line\n"
+            "CONTAINER_REGISTRY_TOKEN=test-token-123\n"
+            "\n"
+            "# Extra whitespace and comments are ignored\n"
+        )
+        result = registry_session.push_with_args("--credsfile", str(creds_file))
+        # Should parse the file successfully
+        output = result.stdout.lower()
+        assert "must contain" not in output
+        assert "credentials file not found" not in output
+
+    def test_push_with_credsfile_quoted_values(self, registry_session, tmp_path):
+        """Test push with credsfile containing quoted values."""
+        registry_session.ensure_running()
+        creds_file = tmp_path / "quoted-creds"
+        creds_file.write_text(
+            'CONTAINER_REGISTRY_USER="quoted-user"\n'
+            "CONTAINER_REGISTRY_PASSWORD='quoted-pass'\n"
+        )
+        result = registry_session.push_with_args("--credsfile", str(creds_file))
+        # Should parse quoted values correctly
+        output = result.stdout.lower()
+        assert "must contain" not in output
+
+    def test_push_with_env_auth_mode_no_creds(self, registry_session, monkeypatch):
+        """Test that env auth mode fails without env vars set."""
+        registry_session.ensure_running()
+        # Clear any existing auth env vars
+        monkeypatch.delenv("CONTAINER_REGISTRY_TOKEN", raising=False)
+        monkeypatch.delenv("CONTAINER_REGISTRY_USER", raising=False)
+        monkeypatch.delenv("CONTAINER_REGISTRY_PASSWORD", raising=False)
+
+        result = registry_session.push_with_args("--auth-mode", "env")
+        assert result.returncode != 0
+        assert "requires" in result.stdout.lower() or "error" in result.stdout.lower()
+
+    def test_push_with_env_auth_mode_token(self, registry_session, monkeypatch):
+        """Test env auth mode with token environment variable."""
+        registry_session.ensure_running()
+        monkeypatch.setenv("CONTAINER_REGISTRY_TOKEN", "test-env-token")
+
+        result = registry_session.push_with_args("--auth-mode", "env")
+        # Should not fail on missing credentials
+        output = result.stdout.lower()
+        assert "requires" not in output or "requires" in output and "token or user" not in output
+
+    def test_push_with_direct_creds_option(self, registry_session):
+        """Test push with --creds option."""
+        registry_session.ensure_running()
+        result = registry_session.push_with_args("--creds", "user:pass")
+        # Should attempt push with credentials
+        # May fail auth but shouldn't fail on parsing
+        output = result.stdout.lower()
+        assert "creds value missing" not in output
+
+    def test_push_with_direct_token_option(self, registry_session):
+        """Test push with --token option."""
+        registry_session.ensure_running()
+        result = registry_session.push_with_args("--token", "test-direct-token")
+        # Should attempt push with token
+        output = result.stdout.lower()
+        assert "token value missing" not in output
+
+    def test_import_with_src_authfile_nonexistent(self, registry_session, tmp_path):
+        """Test import with nonexistent source authfile."""
+        registry_session.ensure_running()
+        nonexistent = tmp_path / "nonexistent-src-auth.json"
+        result = registry_session.run(
+            "import", "docker.io/library/alpine:latest",
+            "--src-authfile", str(nonexistent),
+            check=False
+        )
+        # Skopeo should fail when auth file doesn't exist
+        # Just verify we pass the option through correctly
+        assert result.returncode != 0 or "error" in result.stdout.lower()
+
+    def test_import_with_src_credsfile(self, registry_session, tmp_path):
+        """Test import with source credentials file."""
+        registry_session.ensure_running()
+        creds_file = tmp_path / "src-creds"
+        creds_file.write_text(
+            "CONTAINER_REGISTRY_USER=testuser\n"
+            "CONTAINER_REGISTRY_PASSWORD=testpass\n"
+        )
+        result = registry_session.run(
+            "import", "docker.io/library/alpine:latest",
+            "--src-credsfile", str(creds_file),
+            check=False, timeout=30
+        )
+        # Should parse credentials and attempt import
+        output = result.stdout.lower()
+        assert "must contain" not in output
+        assert "credentials file not found" not in output
+
+    def test_import_with_src_creds_direct(self, registry_session):
+        """Test import with direct source credentials."""
+        registry_session.ensure_running()
+        result = registry_session.run(
+            "import", "docker.io/library/alpine:latest",
+            "--src-creds", "user:pass",
+            check=False, timeout=30
+        )
+        # Should attempt import with credentials
+        # Parsing should succeed even if auth fails
+        pass  # Just verify no crash
+
+
+class TestSecureRegistry:
+    """Test secure registry mode with TLS and authentication.
+
+    These tests verify the secure registry infrastructure:
+    - PKI generation (CA cert, server cert with SAN)
+    - htpasswd authentication setup
+    - HTTPS endpoints
+    - Auto-credential usage for push
+
+    Prerequisites:
+        - openssl and htpasswd must be installed on the system
+        - CONTAINER_REGISTRY_SECURE=1 environment variable
+    """
+
+    @pytest.fixture
+    def secure_env(self, tmp_path, monkeypatch):
+        """Set up environment for secure registry testing."""
+        storage = tmp_path / "container-registry"
+        storage.mkdir()
+        monkeypatch.setenv("CONTAINER_REGISTRY_STORAGE", str(storage))
+        monkeypatch.setenv("CONTAINER_REGISTRY_SECURE", "1")
+        return storage
+
+    def test_help_shows_secure_mode(self, registry):
+        """Test that help documents secure mode."""
+        result = registry.help()
+        output = result.stdout.lower()
+        # Help should mention secure mode or TLS
+        assert "secure" in output or "tls" in output or "https" in output
+
+    def test_start_generates_pki(self, registry, secure_env):
+        """Test that start generates PKI in secure mode."""
+        # Note: Requires openssl and htpasswd installed
+        result = registry.start(timeout=60)
+
+        # Check for missing dependencies
+        output = result.stdout.lower()
+        if "openssl" in output and "not found" in output:
+            pytest.skip("openssl not available")
+        if "htpasswd" in output and "not found" in output:
+            pytest.skip("htpasswd not available")
+
+        # Skip if secure mode not enabled (baked script may not have it)
+        if "secure" not in output and "https" not in output:
+            pytest.skip("Secure mode not enabled in baked script")
+
+        pki_dir = secure_env / "pki"
+        auth_dir = secure_env / "auth"
+
+        # Check PKI files generated
+        assert (pki_dir / "ca.crt").exists(), "CA cert not generated"
+        assert (pki_dir / "ca.key").exists(), "CA key not generated"
+        assert (pki_dir / "server.crt").exists(), "Server cert not generated"
+        assert (pki_dir / "server.key").exists(), "Server key not generated"
+
+        # Check auth files generated
+        assert (auth_dir / "htpasswd").exists(), "htpasswd not generated"
+        assert (auth_dir / "password").exists(), "password file not generated"
+
+        # Verify permissions on sensitive files
+        ca_key_mode = oct((pki_dir / "ca.key").stat().st_mode)[-3:]
+        server_key_mode = oct((pki_dir / "server.key").stat().st_mode)[-3:]
+        password_mode = oct((auth_dir / "password").stat().st_mode)[-3:]
+        assert ca_key_mode == "600", f"CA key has wrong permissions: {ca_key_mode}"
+        assert server_key_mode == "600", f"Server key has wrong permissions: {server_key_mode}"
+        assert password_mode == "600", f"Password file has wrong permissions: {password_mode}"
+
+    def test_start_shows_https_url(self, registry, secure_env):
+        """Test that start shows https:// URL in secure mode."""
+        result = registry.start(timeout=60)
+        output = result.stdout.lower()
+
+        # Skip if secure mode not enabled
+        if "secure" not in output and "https" not in output:
+            pytest.skip("Secure mode not enabled in baked script")
+
+        assert "https://" in result.stdout
+
+    def test_pki_not_regenerated(self, registry, secure_env):
+        """Test that existing PKI is not overwritten."""
+        # First start generates PKI
+        result = registry.start(timeout=60)
+        output = result.stdout.lower()
+
+        # Skip if secure mode not enabled
+        if "secure" not in output and "https" not in output:
+            pytest.skip("Secure mode not enabled in baked script")
+
+        pki_dir = secure_env / "pki"
+        if not (pki_dir / "ca.crt").exists():
+            pytest.skip("PKI not generated (missing dependencies?)")
+
+        ca_crt_mtime = (pki_dir / "ca.crt").stat().st_mtime
+
+        # Stop and restart
+        registry.stop()
+        time.sleep(1)
+        registry.start(timeout=60)
+
+        # CA cert should not be regenerated
+        new_mtime = (pki_dir / "ca.crt").stat().st_mtime
+        assert new_mtime == ca_crt_mtime, "CA cert was regenerated"
+
+    def test_custom_username(self, registry, secure_env, monkeypatch):
+        """Test custom username configuration."""
+        monkeypatch.setenv("CONTAINER_REGISTRY_USERNAME", "customuser")
+        result = registry.start(timeout=60)
+        output = result.stdout.lower()
+
+        # Skip if secure mode not enabled
+        if "secure" not in output and "https" not in output:
+            pytest.skip("Secure mode not enabled in baked script")
+
+        htpasswd = secure_env / "auth" / "htpasswd"
+        if not htpasswd.exists():
+            pytest.skip("htpasswd not generated (missing dependencies?)")
+
+        content = htpasswd.read_text()
+        assert content.startswith("customuser:"), f"htpasswd should start with customuser: but got {content[:20]}"
+
+    def test_custom_password(self, registry, secure_env, monkeypatch):
+        """Test custom password configuration."""
+        monkeypatch.setenv("CONTAINER_REGISTRY_PASSWORD", "custompass123")
+        result = registry.start(timeout=60)
+        output = result.stdout.lower()
+
+        # Skip if secure mode not enabled
+        if "secure" not in output and "https" not in output:
+            pytest.skip("Secure mode not enabled in baked script")
+
+        password_file = secure_env / "auth" / "password"
+        if not password_file.exists():
+            pytest.skip("password file not generated (missing dependencies?)")
+
+        password = password_file.read_text().strip()
+        assert password == "custompass123", f"Password should be custompass123 but got {password}"
+
+    def test_server_cert_san(self, registry, secure_env):
+        """Test that server cert includes expected SAN entries."""
+        result = registry.start(timeout=60)
+        output = result.stdout.lower()
+
+        # Skip if secure mode not enabled
+        if "secure" not in output and "https" not in output:
+            pytest.skip("Secure mode not enabled in baked script")
+
+        server_crt = secure_env / "pki" / "server.crt"
+        if not server_crt.exists():
+            pytest.skip("Server cert not generated (missing dependencies?)")
+
+        cert_result = subprocess.run(
+            ["openssl", "x509", "-in", str(server_crt), "-noout", "-text"],
+            capture_output=True, text=True
+        )
+
+        if cert_result.returncode != 0:
+            pytest.skip("openssl not available")
+
+        cert_text = cert_result.stdout
+
+        # Check SAN entries
+        assert "DNS:localhost" in cert_text, "Server cert missing DNS:localhost SAN"
+        assert "IP Address:127.0.0.1" in cert_text, "Server cert missing IP:127.0.0.1 SAN"
+        assert "IP Address:10.0.2.2" in cert_text, "Server cert missing IP:10.0.2.2 SAN"
+
+    def test_push_uses_credentials(self, registry, secure_env):
+        """Test that push auto-uses generated credentials in secure mode."""
+        result = registry.start(timeout=60)
+        output = result.stdout.lower()
+
+        # Skip if secure mode not enabled
+        if "secure" not in output and "https" not in output:
+            pytest.skip("Secure mode not enabled in baked script")
+
+        # Attempt push - it should use auto-generated credentials
+        push_result = registry.run("push", check=False, timeout=120)
+        push_output = push_result.stdout.lower()
+
+        # Should not show "unauthorized" errors (credentials should work)
+        # May show "no images" which is fine
+        assert "unauthorized" not in push_output, "Push failed with unauthorized - credentials not used"
+
+    @pytest.mark.network
+    @pytest.mark.slow
+    def test_secure_import(self, registry, secure_env, skip_network):
+        """Test importing with TLS verification."""
+        if skip_network:
+            pytest.skip("Network tests disabled (--skip-registry-network)")
+
+        result = registry.start(timeout=60)
+        output = result.stdout.lower()
+
+        # Skip if secure mode not enabled
+        if "secure" not in output and "https" not in output:
+            pytest.skip("Secure mode not enabled in baked script")
+
+        # Import should work with our CA cert
+        import_result = registry.import_image(
+            "docker.io/library/alpine:latest",
+            timeout=300
+        )
+        assert import_result.returncode == 0, f"Import failed: {import_result.stdout}"
+
+    def test_tls_curl_verification(self, registry, secure_env):
+        """Test that curl can verify the registry TLS."""
+        result = registry.start(timeout=60)
+        output = result.stdout.lower()
+
+        # Skip if secure mode not enabled
+        if "secure" not in output and "https" not in output:
+            pytest.skip("Secure mode not enabled in baked script")
+
+        ca_cert = secure_env / "pki" / "ca.crt"
+        password_file = secure_env / "auth" / "password"
+
+        if not ca_cert.exists() or not password_file.exists():
+            pytest.skip("PKI/auth not generated (missing dependencies?)")
+
+        password = password_file.read_text().strip()
+
+        curl_result = subprocess.run([
+            "curl", "-s", "--cacert", str(ca_cert),
+            "-u", f"yocto:{password}",
+            "https://localhost:5000/v2/_catalog"
+        ], capture_output=True, text=True, timeout=30)
+
+        # Should get valid JSON response
+        assert curl_result.returncode == 0 or "repositories" in curl_result.stdout, \
+            f"Curl TLS verification failed: {curl_result.stderr}"
+
+    def test_status_shows_secure_mode(self, registry, secure_env):
+        """Test that status indicates secure mode."""
+        result = registry.start(timeout=60)
+        start_output = result.stdout.lower()
+
+        # Skip if secure mode not enabled
+        if "secure" not in start_output and "https" not in start_output:
+            pytest.skip("Secure mode not enabled in baked script")
+
+        status_result = registry.status()
+        status_output = status_result.stdout.lower()
+
+        # Status should indicate secure/TLS mode
+        assert "https" in status_output or "secure" in status_output or "tls" in status_output, \
+            "Status should indicate secure mode"
+
+
+class TestSecureRegistryTLSOnly:
+    """Test TLS-only mode (SECURE=1, AUTH=0).
+
+    When AUTH is not enabled, the registry should:
+    - Use HTTPS (TLS) for connections
+    - NOT require authentication
+    - Allow anonymous pull/push
+
+    These tests work with an already-running secure registry.
+    """
+
+    @pytest.fixture
+    def registry_storage(self, registry):
+        """Get registry storage path from the script."""
+        result = registry.run("info", check=False)
+        # Parse storage path from info output
+        for line in result.stdout.splitlines():
+            if "Storage:" in line:
+                return Path(line.split("Storage:")[-1].strip())
+        # Fall back to common locations
+        for candidate in [
+            Path(os.environ.get("TOPDIR", "")) / "container-registry",
+            Path.cwd() / "container-registry",
+            Path.cwd().parent / "container-registry",
+        ]:
+            if candidate.exists():
+                return candidate
+        pytest.skip("Cannot determine registry storage path")
+
+    def _ensure_secure_registry(self, registry):
+        """Ensure a secure registry is running, starting one if needed."""
+        status = registry.status()
+        if status.returncode == 0:
+            # Already running - verify it's secure
+            if "secure" not in status.stdout.lower() and "tls" not in status.stdout.lower():
+                pytest.skip("Registry running but not in secure mode")
+            return
+
+        # Not running - try to start it
+        result = registry.start(timeout=60)
+        if result.returncode != 0:
+            pytest.skip(f"Could not start registry: {result.stderr}")
+        import time
+        time.sleep(2)
+
+        status = registry.status()
+        if status.returncode != 0:
+            pytest.skip("Registry failed to start")
+        if "secure" not in status.stdout.lower() and "tls" not in status.stdout.lower():
+            pytest.skip("Registry started but not in secure mode")
+
+    def test_status_shows_tls_only(self, registry):
+        """Test that status shows TLS-only mode (not TLS+auth)."""
+        self._ensure_secure_registry(registry)
+        status = registry.status()
+        status_output = status.stdout.lower()
+
+        # Should show secure mode
+        assert "secure" in status_output or "tls" in status_output, \
+            "Status should indicate secure mode"
+        # In TLS-only mode, should say "tls only" not "tls + auth"
+        if "tls only" in status_output:
+            assert "tls + auth" not in status_output
+
+    def test_curl_without_auth(self, registry, registry_storage):
+        """Test that curl can access registry without credentials."""
+        self._ensure_secure_registry(registry)
+
+        ca_cert = registry_storage / "pki" / "ca.crt"
+        if not ca_cert.exists():
+            pytest.skip("CA cert not found")
+
+        # Access WITHOUT credentials should work in TLS-only mode
+        curl_result = subprocess.run([
+            "curl", "-s", "--cacert", str(ca_cert),
+            "https://localhost:5000/v2/_catalog"
+        ], capture_output=True, text=True, timeout=30)
+
+        assert "repositories" in curl_result.stdout, \
+            f"TLS-only registry should not require auth: {curl_result.stderr}"
+
+    def test_config_has_no_auth_section(self, registry, registry_storage):
+        """Test that generated registry config has no active auth section."""
+        self._ensure_secure_registry(registry)
+
+        config_file = registry_storage / "registry-config.yml"
+        if not config_file.exists():
+            pytest.skip("Config file not found")
+
+        config_content = config_file.read_text()
+        # Check that the actual YAML auth: key is not present as a config directive
+        # (comments mentioning htpasswd are fine, only the active auth block matters)
+        non_comment_lines = [
+            line for line in config_content.splitlines()
+            if line.strip() and not line.strip().startswith('#')
+        ]
+        active_config = '\n'.join(non_comment_lines)
+        assert "auth:" not in active_config, \
+            "TLS-only config should not have an active auth: section"
+        assert "tls:" in config_content, \
+            "TLS-only config should contain TLS section"
+
+    def test_pki_exists(self, registry, registry_storage):
+        """Test that PKI infrastructure exists."""
+        self._ensure_secure_registry(registry)
+
+        pki_dir = registry_storage / "pki"
+        assert (pki_dir / "ca.crt").exists(), "CA cert should exist"
+        assert (pki_dir / "server.crt").exists(), "Server cert should exist"
+        assert (pki_dir / "server.key").exists(), "Server key should exist"
+
+    def test_no_htpasswd_generated(self, registry, registry_storage):
+        """Test that TLS-only mode does not require htpasswd authentication.
+
+        Note: A stale auth/htpasswd may exist from previous runs when auth
+        was enabled. We verify the functional behavior: the registry config
+        has no auth section and anonymous access works (tested separately
+        in test_curl_without_auth). Here we check the config file.
+        """
+        self._ensure_secure_registry(registry)
+
+        config_file = registry_storage / "registry-config.yml"
+        if not config_file.exists():
+            pytest.skip("Config file not found")
+
+        config_content = config_file.read_text()
+        non_comment_lines = [
+            line for line in config_content.splitlines()
+            if line.strip() and not line.strip().startswith('#')
+        ]
+        active_config = '\n'.join(non_comment_lines)
+        assert "auth:" not in active_config, \
+            "TLS-only config should not reference htpasswd authentication"
+
+    def test_info_shows_no_auth(self, registry):
+        """Test that info command reflects TLS-only (no auth section)."""
+        self._ensure_secure_registry(registry)
+
+        info_result = registry.run("info", check=False)
+        info_output = info_result.stdout
+
+        assert "PKI" in info_result.stdout or "pki" in info_result.stdout.lower(), \
+            "Info should show PKI directory"
+        assert "Password file" not in info_result.stdout, \
+            "Info should not show password file in TLS-only mode"
+
+
+class TestSecureRegistryWithAuth:
+    """Test TLS+auth mode (SECURE=1, AUTH=1).
+
+    Uses an isolated registry instance on port 5001 with its own
+    storage directory, so it never touches the user's running registry.
+    """
+
+    TEST_PORT = "5001"
+
+    @pytest.fixture
+    def auth_registry(self, registry, tmp_path, monkeypatch):
+        """Start an isolated auth-enabled registry on a different port."""
+        storage = tmp_path / "auth-registry"
+        storage.mkdir()
+
+        monkeypatch.setenv("CONTAINER_REGISTRY_STORAGE", str(storage))
+        monkeypatch.setenv("CONTAINER_REGISTRY_SECURE", "1")
+        monkeypatch.setenv("CONTAINER_REGISTRY_AUTH", "1")
+        monkeypatch.setenv("CONTAINER_REGISTRY_URL", f"localhost:{self.TEST_PORT}")
+
+        start_result = registry.start(timeout=60)
+        if start_result.returncode != 0:
+            pytest.skip(f"Could not start auth registry: {start_result.stderr}")
+
+        output = start_result.stdout.lower()
+        if "secure" not in output and "https" not in output:
+            registry.stop()
+            pytest.skip("Script does not support secure mode")
+        if "htpasswd" in output and "not found" in output:
+            registry.stop()
+            pytest.skip("htpasswd not available")
+
+        import time
+        time.sleep(2)
+        yield storage
+
+        registry.stop()
+
+    def test_curl_requires_auth(self, registry, auth_registry):
+        """Test that curl without credentials is rejected."""
+        ca_cert = auth_registry / "pki" / "ca.crt"
+        if not ca_cert.exists():
+            pytest.skip("CA cert not found")
+
+        curl_result = subprocess.run([
+            "curl", "-s", "-o", "/dev/null", "-w", "%{http_code}",
+            "--cacert", str(ca_cert),
+            f"https://localhost:{self.TEST_PORT}/v2/_catalog"
+        ], capture_output=True, text=True, timeout=30)
+
+        assert "401" in curl_result.stdout, \
+            f"Auth-enabled registry should reject unauthenticated requests, got: {curl_result.stdout}"
+
+    def test_curl_with_auth_succeeds(self, registry, auth_registry):
+        """Test that curl with credentials succeeds."""
+        ca_cert = auth_registry / "pki" / "ca.crt"
+        password_file = auth_registry / "auth" / "password"
+        if not ca_cert.exists() or not password_file.exists():
+            pytest.skip("PKI/auth not generated")
+
+        password = password_file.read_text().strip()
+
+        curl_result = subprocess.run([
+            "curl", "-s", "--cacert", str(ca_cert),
+            "-u", f"yocto:{password}",
+            f"https://localhost:{self.TEST_PORT}/v2/_catalog"
+        ], capture_output=True, text=True, timeout=30)
+
+        assert "repositories" in curl_result.stdout, \
+            f"Authenticated request should succeed: {curl_result.stderr}"
+
+    def test_config_has_auth_section(self, registry, auth_registry):
+        """Test that generated registry config includes auth section."""
+        config_file = auth_registry / "registry-config.yml"
+        if not config_file.exists():
+            pytest.skip("Config file not found")
+
+        config_content = config_file.read_text()
+        assert "htpasswd" in config_content, \
+            "Auth-enabled config should contain htpasswd section"
+        assert "tls:" in config_content, \
+            "Auth-enabled config should also contain TLS section"
+
+    def test_htpasswd_generated(self, registry, auth_registry):
+        """Test that htpasswd file is generated in auth mode."""
+        auth_dir = auth_registry / "auth"
+        assert (auth_dir / "htpasswd").exists(), "htpasswd not generated in auth mode"
+        assert (auth_dir / "password").exists(), "password file not generated"
+
+
+class TestDockerRegistryConfig:
+    """Test docker-registry-config.bb behavior.
+
+    Verifies the bitbake recipe logic for generating Docker daemon
+    configuration on target images, specifically:
+    - localhost→10.0.2.2 translation for QEMU targets
+    - CA cert installation path matches registry host
+    """
+
+    def test_bbclass_has_auth_variable(self):
+        """Test that container-registry.bbclass defines CONTAINER_REGISTRY_AUTH."""
+        bbclass = Path("/opt/bruce/poky/meta-virtualization/classes/container-registry.bbclass")
+        if not bbclass.exists():
+            pytest.skip("container-registry.bbclass not found")
+
+        content = bbclass.read_text()
+        assert 'CONTAINER_REGISTRY_AUTH' in content, \
+            "bbclass should define CONTAINER_REGISTRY_AUTH variable"
+        assert 'CONTAINER_REGISTRY_AUTH ?= "0"' in content, \
+            "CONTAINER_REGISTRY_AUTH should default to 0"
+
+    def test_bbclass_validates_auth_requires_secure(self):
+        """Test that bbclass warns when AUTH=1 without SECURE=1."""
+        bbclass = Path("/opt/bruce/poky/meta-virtualization/classes/container-registry.bbclass")
+        if not bbclass.exists():
+            pytest.skip("container-registry.bbclass not found")
+
+        content = bbclass.read_text()
+        assert "auth and not secure" in content or "AUTH" in content, \
+            "bbclass should validate that AUTH requires SECURE"
+
+    def test_docker_registry_config_translates_localhost(self):
+        """Test that docker-registry-config.bb translates localhost to 10.0.2.2."""
+        recipe = Path("/opt/bruce/poky/meta-virtualization/recipes-containers/"
+                      "container-registry/docker-registry-config.bb")
+        if not recipe.exists():
+            pytest.skip("docker-registry-config.bb not found")
+
+        content = recipe.read_text()
+        assert "10.0.2.2" in content, \
+            "Recipe should translate localhost to 10.0.2.2 for QEMU"
+        assert "replace" in content.lower() and "localhost" in content, \
+            "Recipe should replace localhost with 10.0.2.2"
+
+    def test_docker_registry_config_translates_127(self):
+        """Test that docker-registry-config.bb also translates 127.0.0.1."""
+        recipe = Path("/opt/bruce/poky/meta-virtualization/recipes-containers/"
+                      "container-registry/docker-registry-config.bb")
+        if not recipe.exists():
+            pytest.skip("docker-registry-config.bb not found")
+
+        content = recipe.read_text()
+        assert "127.0.0.1" in content, \
+            "Recipe should also translate 127.0.0.1 to 10.0.2.2"
+
+
+class TestContainerCrossInstallSecure:
+    """Test container-cross-install.bbclass secure registry integration.
+
+    Verifies that the cross-install class automatically adds the
+    docker-registry-config package when CONTAINER_REGISTRY_SECURE=1.
+    """
+
+    def test_cross_install_auto_adds_registry_config(self):
+        """Test that cross-install adds docker-registry-config when SECURE=1."""
+        bbclass = Path("/opt/bruce/poky/meta-virtualization/classes/"
+                       "container-cross-install.bbclass")
+        if not bbclass.exists():
+            pytest.skip("container-cross-install.bbclass not found")
+
+        content = bbclass.read_text()
+        assert "CONTAINER_REGISTRY_SECURE" in content, \
+            "Cross-install should check CONTAINER_REGISTRY_SECURE"
+        assert "docker-registry-config" in content, \
+            "Cross-install should add docker-registry-config in secure mode"
+
+    def test_cross_install_supports_podman_config(self):
+        """Test that cross-install adds container-oci-registry-config for podman."""
+        bbclass = Path("/opt/bruce/poky/meta-virtualization/classes/"
+                       "container-cross-install.bbclass")
+        if not bbclass.exists():
+            pytest.skip("container-cross-install.bbclass not found")
+
+        content = bbclass.read_text()
+        assert "container-oci-registry-config" in content, \
+            "Cross-install should support podman registry config"
+
+    def test_cross_install_checks_container_engine(self):
+        """Test that cross-install selects config package based on engine."""
+        bbclass = Path("/opt/bruce/poky/meta-virtualization/classes/"
+                       "container-cross-install.bbclass")
+        if not bbclass.exists():
+            pytest.skip("container-cross-install.bbclass not found")
+
+        content = bbclass.read_text()
+        assert "VIRTUAL-RUNTIME_container_engine" in content, \
+            "Cross-install should check container engine to select config package"
+
+
+class TestVcontainerSecureRegistry:
+    """Test vcontainer shell script secure registry support.
+
+    Verifies the host-side scripts handle CA certificates correctly:
+    - Auto-detection of bundled CA cert
+    - CA cert transport via virtio-9p (not kernel cmdline)
+    - Daemon mode sets _9p=1 for share mounting
+    """
+
+    def test_vcontainer_common_auto_detects_ca_cert(self):
+        """Test that vcontainer-common.sh auto-detects bundled CA cert."""
+        script = Path("/opt/bruce/poky/meta-virtualization/recipes-containers/"
+                      "vcontainer/files/vcontainer-common.sh")
+        if not script.exists():
+            pytest.skip("vcontainer-common.sh not found")
+
+        content = script.read_text()
+        assert "registry/ca.crt" in content, \
+            "Should check for bundled CA cert at registry/ca.crt"
+        assert "BUNDLED_CA_CERT" in content, \
+            "Should define BUNDLED_CA_CERT variable"
+        assert 'SECURE_REGISTRY="true"' in content, \
+            "Should auto-enable SECURE_REGISTRY when CA cert found"
+
+    def test_vrunner_passes_ca_via_virtio9p(self):
+        """Test that vrunner.sh passes CA cert via virtio-9p, not cmdline."""
+        script = Path("/opt/bruce/poky/meta-virtualization/recipes-containers/"
+                      "vcontainer/files/vrunner.sh")
+        if not script.exists():
+            pytest.skip("vrunner.sh not found")
+
+        content = script.read_text()
+
+        # Should copy CA cert to shared folder in daemon mode
+        assert "DAEMON_SHARE_DIR" in content and "ca.crt" in content, \
+            "Should copy CA cert to DAEMON_SHARE_DIR in daemon mode"
+
+        # Should NOT base64 encode CA cert for cmdline
+        assert "base64" not in content.split("CA_CERT")[0].split("CA_CERT")[-1] \
+            or "registry_pass" in content, \
+            "Should not base64 encode CA cert for kernel cmdline"
+
+    def test_vrunner_daemon_sets_9p(self):
+        """Test that daemon mode sets _9p=1 in kernel cmdline."""
+        script = Path("/opt/bruce/poky/meta-virtualization/recipes-containers/"
+                      "vcontainer/files/vrunner.sh")
+        if not script.exists():
+            pytest.skip("vrunner.sh not found")
+
+        content = script.read_text()
+
+        # Find the daemon mode block and check for _9p=1
+        # The daemon block should contain both virtfs and _9p=1
+        lines = content.split('\n')
+        in_daemon_block = False
+        daemon_has_virtfs = False
+        daemon_has_9p = False
+        for line in lines:
+            if 'DAEMON_MODE" = "start"' in line or "DAEMON_MODE\" = \"start\"" in line:
+                in_daemon_block = True
+            if in_daemon_block:
+                if "virtfs" in line and "DAEMON_SHARE_DIR" in line:
+                    daemon_has_virtfs = True
+                if "_9p=1" in line:
+                    daemon_has_9p = True
+                # Detect end of the if block (next top-level statement)
+                if line.startswith("fi") and in_daemon_block and daemon_has_virtfs:
+                    break
+
+        assert daemon_has_virtfs, "Daemon mode should set up virtio-9p share"
+        assert daemon_has_9p, "Daemon mode should set _9p=1 in kernel cmdline"
+
+    def test_vrunner_nondaemon_ca_cert_virtio9p(self):
+        """Test that non-daemon mode creates virtio-9p share for CA cert."""
+        script = Path("/opt/bruce/poky/meta-virtualization/recipes-containers/"
+                      "vcontainer/files/vrunner.sh")
+        if not script.exists():
+            pytest.skip("vrunner.sh not found")
+
+        content = script.read_text()
+        assert "CA_SHARE_DIR" in content, \
+            "Non-daemon mode should create CA_SHARE_DIR for virtio-9p"
+        assert "cashare" in content, \
+            "Should add virtio-9p device for CA cert sharing"
+
+    def test_vdkr_init_reads_ca_from_share(self):
+        """Test that vdkr-init.sh reads CA cert from /mnt/share/ca.crt."""
+        script = Path("/opt/bruce/poky/meta-virtualization/recipes-containers/"
+                      "vcontainer/files/vdkr-init.sh")
+        if not script.exists():
+            pytest.skip("vdkr-init.sh not found")
+
+        content = script.read_text()
+        assert "/mnt/share/ca.crt" in content, \
+            "Should check for CA cert at /mnt/share/ca.crt"
+
+    def test_vdkr_init_no_base64_ca_decode(self):
+        """Test that vdkr-init.sh no longer decodes base64 CA from cmdline."""
+        script = Path("/opt/bruce/poky/meta-virtualization/recipes-containers/"
+                      "vcontainer/files/vdkr-init.sh")
+        if not script.exists():
+            pytest.skip("vdkr-init.sh not found")
+
+        content = script.read_text()
+        # Should NOT have docker_registry_ca=<base64> pattern in cmdline parsing
+        assert "docker_registry_ca=" not in content or "docker_registry_ca=1" in content, \
+            "Should not parse base64 CA cert from kernel cmdline"
+
+    def test_vdkr_init_copies_ca_from_share(self):
+        """Test that vdkr-init.sh copies CA cert from shared folder."""
+        script = Path("/opt/bruce/poky/meta-virtualization/recipes-containers/"
+                      "vcontainer/files/vdkr-init.sh")
+        if not script.exists():
+            pytest.skip("vdkr-init.sh not found")
+
+        content = script.read_text()
+        # Should copy from DOCKER_REGISTRY_CA (which is /mnt/share/ca.crt)
+        assert "cp" in content and "DOCKER_REGISTRY_CA" in content, \
+            "Should copy CA cert from shared folder path"
+        assert "/etc/docker/certs.d/" in content, \
+            "Should install CA cert to Docker certs.d directory"
+
+    def test_vcontainer_tarball_tracks_scripts(self):
+        """Test that vcontainer-tarball.bb tracks script files via SRC_URI."""
+        recipe = Path("/opt/bruce/poky/meta-virtualization/recipes-containers/"
+                      "vcontainer/vcontainer-tarball.bb")
+        if not recipe.exists():
+            pytest.skip("vcontainer-tarball.bb not found")
+
+        content = recipe.read_text()
+        assert "SRC_URI" in content, "Should have SRC_URI for file tracking"
+        assert "vrunner.sh" in content, "Should track vrunner.sh"
+        assert "vcontainer-common.sh" in content, "Should track vcontainer-common.sh"