BLOB(1)

💖 BLOB(1) — the group chat rundown 💖

okay bestie, so this is the manual for blob, and it lives in the User Commands corner of your friendly neighbourhood man pages. it's a whole vibe. let's get into it 🫶

---

✨ NAME ✨

blob — the APT method helper for Azure Blob Storage repositories. yes she's a helper. yes she's booked and busy. periodt 💅

---

🌸 SYNOPSIS 🌸

blob

that's it. that's the whole synopsis. no flags. no args. she simply is 🦋

---

💜 DESCRIPTION 💜

so blob is the APT method helper that ships with apt-transport-blob. the moment you install it, APT can go grab repository metadata and actual packages from Azure Blob Storage URLs — the ones that use the blob:// scheme. iconic behaviour, honestly 🔥

she implements the APT method protocol, which means she's normally called by APT, not by you, not by me, not by anyone just vibing in a terminal. she's not a "run me directly" kind of girl. she's backstage crew with main character energy 👑

---

🌈 URL FORMAT 🌈

APT source entries are allowed to use URLs shaped like this:

blob://ACCOUNT.blob.core.windows.net/CONTAINER/PATH

what does our girl do with that? she translates it into HTTPS requests against the same host and path, and she does it using Azure Storage bearer-token authentication. glow up in one step ✨

---

🎀 AUTHENTICATION 🎀

first things first: whichever Azure credential you pick has to actually be authorized to read the blob container. for example, with the Storage Blob Data Reader role. no role, no reads, no package, no you. soz 😭

the credentials get tried in this exact order:

• AZURE_STORAGE_BEARER_TOKEN — a bearer token for Azure Storage. you can cop one with:

az account get-access-token --output tsv --query accessToken --resource https://storage.azure.com

• Workload identity — set AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_FEDERATED_TOKEN_FILE.
• Client secret — set AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_CLIENT_SECRET.
• Azure CLI — uses an existing Azure CLI login session (like, say, after you've run az login). casual 💅
• Managed identity — on Azure compute, the helper can grab a token from the Instance Metadata Service. this one is tried last because it needs a network request, and that request can time out when you're outside Azure. so it's the "if literally everything else failed" option 🙈

---

🧚 ENVIRONMENT 🧚

these are the env vars she's obsessed with:

• AZURE_AUTHORITY_HOST — overrides the Azure Active Directory authority host used for workload identity and client-secret authentication.
• AZURE_STORAGE_BEARER_TOKEN — bearer token used directly for Azure Storage requests.
• AZURE_TENANT_ID — tenant ID used for workload identity and client-secret authentication.
• AZURE_CLIENT_ID — client ID used for workload identity and client-secret authentication.
• AZURE_FEDERATED_TOKEN_FILE — path to a federated identity token file used for workload identity.
• AZURE_CLIENT_SECRET — client secret used for client-secret authentication.

love that for her 🌸

---

🍓 FILES 🍓

• /usr/lib/apt/methods/blob — the APT method helper installed by this package. yes, that's her. that's the girl.
• /var/log/apt-transport-blob.log — debug log written by the helper. when things go sideways, this is where the receipts live 💀

---

👑 SEE ALSO 👑

apt(8), sources.list(5), az(1)

---

and that's the whole page, bestie — no notes, 10/10, would read again 🌟

this little masterpiece is brought to you by apt-transport-blob, dated June 2026, and it is very much BLOB(1) coded 💖✨🎀