From a security perspective, I don't like the idea of relying only on Git tags, as they could be moved later. Unfortunately, I'm not aware of an official solution to enforce checks.

This is the best that I could come up with:

# requirements.yaml:
- src: git+https://github.com/geerlingguy/ansible-role-nodejs.git
  version: 405a113ccbde0c99614f6f815fb4285cb742ad25 # == release 5.0.0
  name: geerlingguy.nodejs.trusted_hash

And in the playbook, use it as:

- roles:
  - role: geerlingguy.nodejs.trusted_hash
    nodejs_version: "12.x"

It works, but feels a bit overly complicated. Is there an easier way?

  • 1
    Did you check the issue list? If there is no such item, could you create one and add the link to this Q&A to create awareness? – 030 Nov 18 '19 at 12:01
  • 1
    @030 Did not find any, although there were older discussion about it. I created a new one: github.com/ansible/galaxy/issues/2108 – Philipp Claßen Nov 18 '19 at 12:29
  • 1
    In the meantime could you answer the question (even if in the negative?), with your findings? Thanks! – Bruce Becker Nov 18 '19 at 13:36
  • I also wonder - perhaps hashes can be altered, but what about verifying signed tags or commits, with the signers public key? This would likely have to be done outside of galaxy, but it should still show signs of tampering if they were present. – Bruce Becker Nov 18 '19 at 13:38
  • @BruceBecker I added a answer based on my current understanding. – Philipp Claßen Nov 18 '19 at 14:44

The feature is currently (Nov 2019) not directly supported in Ansible Galaxy.

There have been related discussions in the past (#14604 and #1358), but the latest state can be followed in the new issue #2108.

In the meantime, the workaround described in the question can be used, at the cost of some verbosity.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.