I am getting started with arduino-cli. I created my first sketch with arduino-cli sketch new MyFirstSketch. It created a folder with a .ino inside of it alongside an inventory.yaml next to the folder:
installation:
id: ***
secret: ***
I am curious what the .yaml file is for. Is it required?
Also before I edited this post the full id and secret were written in the original draft. What are those? Should I be deleting this post? "secret" sounds sensitive but I have no idea what its for.
My guess is that this is an Ansible or Puppet file. Are you sure it was arduino-cli that created this file? I just tested this with version 0.28.0 and I did not find anything of the sort.
Strange. As mentioned before, I have never seen this and I can not reproduce this with the latest version of arduino-cli. Maybe @ptillisch knows what might be going on.
Module inventory
This module leverages an additional Viper instance, in order to create a configuration repository that contains values that may create confusion in the user-facing arduino-cli.yaml file, polluting it.
Arduino CLI has a configuration file named arduino-cli.yaml. This file is for user to configure Arduino CLI:
Arduino CLI also has the need for a place to store persistent data for its internal use. Rather than adding some confusing things of no interest to the user in arduino-cli.yaml, the developer decided to made a dedicated file for this purpose, which they named inventory.yaml.
Arduino CLI automatically generates it if it does not exist already. So there is no way to stop Arduino CLI from creating this file, but you can safely delete it whenever you like.
These are arbitrary "Universally Unique Identifiers" (UUID) generated by Arduino CLI. They were added for use with the optional (disabled by default, but available for activation by the user via a setting in the arduino-cli.yaml file) telemetry feature:
installation.id is used to associate the telemetry data with a specific installation of Arduino CLI.
installation.secret is used to anonymize personally identifiable information (in this case, the file paths used during the compilation process) in the telemetry data, as is best practices in such applications (and perhaps required by law depending on who is collecting the data).
Over time, it did not seem that users found the telemetry/metrics capability of Arduino CLI to be useful and it was a maintenance burden for the developers, so it was removed:
So at this time the installation.id and installation.secret values are not used for anything at all. They are just some random gibberish in the inventory.yaml file. I guess the developers thought they might eventually be useful for something else, or maybe they just forgot to remove that code when they removed the metrics feature.
The installation.secret value might be used to de-anonymize your personally identifiable information in a database created through the use of the Arduino CLI metrics feature. However, unless you set up such a data collection system using the metrics feature with an older version of Arduino CLI that supported it or used a 3rd party application that used the feature, then no such data exists and the secret is not something that must be protected.
If you are concerned about it, you can click the icon on the bottom of your post and request the moderators to hide the edit history so that the secret will no longer be publicly visible.
Now that I have explained the origin of this file and the obsolete installation field data, I will also tell you about the feature inventory.yaml is still used for by Arduino CLI:
Arduino CLI periodically checks to see if a newer version is available (this behavior is configurable via arduino-cli.yaml), in which case it will print a message to notify you, something like this:
A new release of Arduino CLI is available: 0.26.0 → 0.28.0
https://arduino.github.io/arduino-cli/latest/installation/#latest-packages
That is a useful feature, but you wouldn't want the thing checking for it at every command. So it only checks once every 24 hours. In order to accomplish that, it must store the timestamp of the last update check. This is stored in the updater.last_check_time of inventory.yaml.
icon on the bottom of your post and request the moderators to hide the edit history so that the secret will no longer be publicly visible.