2

From a security perspective, I don't like the idea of relying only on Git tags, as they could be moved later. Unfortunately, I'm not aware of an official solution to enforce checks.

This is the best that I could come up with:

# requirements.yaml:
- src: git+https://github.com/geerlingguy/ansible-role-nodejs.git
  version: 405a113ccbde0c99614f6f815fb4285cb742ad25 # == release 5.0.0
  name: geerlingguy.nodejs.trusted_hash

And in the playbook, use it as:

- roles:
  - role: geerlingguy.nodejs.trusted_hash
    nodejs_version: "12.x"

It works, but feels a bit overly complicated. Is there an easier way?

Improve this question
5
  • 1
    Did you check the issue list? If there is no such item, could you create one and add the link to this Q&A to create awareness?
    – 030
    Nov 18, 2019 at 12:01
  • 1
    @030 Did not find any, although there were older discussion about it. I created a new one: github.com/ansible/galaxy/issues/2108
    – Philipp Claßen
    Nov 18, 2019 at 12:29
  • 1
    In the meantime could you answer the question (even if in the negative?), with your findings? Thanks!
    – Bruce Becker
    Nov 18, 2019 at 13:36
  • I also wonder - perhaps hashes can be altered, but what about verifying signed tags or commits, with the signers public key? This would likely have to be done outside of galaxy, but it should still show signs of tampering if they were present.
    – Bruce Becker
    Nov 18, 2019 at 13:38
  • @BruceBecker I added a answer based on my current understanding.
    – Philipp Claßen
    Nov 18, 2019 at 14:44

1 Answer 1

Reset to default
1

The feature is currently (Nov 2019) not directly supported in Ansible Galaxy.

There have been related discussions in the past (#14604 and #1358), but the latest state can be followed in the new issue #2108.

In the meantime, the workaround described in the question can be used, at the cost of some verbosity.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.