Support `--valid_pgpkeys` option in Git module () #55396

jelly · 2019-04-16T19:37:53Z

Make Git module support --valid-pgpkeys option, which allows
configuring a list of valid PGP fingerprints which are compared with the
used PGP fingerprint if verify_commit is true. This requires
verify_commit to be set to 'yes'.

Signed-off-by: Jelle van der Waa jelle@vdwaa.nl

SUMMARY

Add an option to specify allows PGP fingerprints from which signed commits are excepted this adds an extra verification requirement when verify_commit is set. Basically this prevents a trusted repository with a malicious signed commit to be seen as a valid commit. This is comparable with Arch Linux's pacman's PKGBUILD which allows the same sort of syntax to specify valid PGP keys.

ISSUE TYPE

Feature Pull Request

COMPONENT NAME

Git module

ADDITIONAL INFORMATION

Adds a new option to the Git module called valid_pgpkeys with an array of valid PGP keys to be used to verify the signed commit.

- name: test my new module
  hosts: localhost
  tasks:
  - name: 
    git:
      repo: 'https://github.com/archlinux/archweb.git'
      dest: /tmp/archweb
      verify_commit: yes
      version: release_2019-04-15
      valid_pgpkeys:
        - 'E499C79F53C96A54E572FEE1C06086337C50773F'

On error:

fatal: [localhost]: FAILED! => {"changed": false, "msg": "Public key \"E499C79F53C96A54E572FEE1C06086337C50773E\" missing from the whitelist", "rc": 0, ...

lib/ansible/modules/source_control/git.py

jelly · 2019-05-06T14:09:07Z

Any update?

webknjaz

It's a nice patch, yet it requires a few bits of polishing.
There's a few style improvements I've suggested and we also 100% need to improve the consistency with the argument naming.

lib/ansible/modules/source_control/git.py

webknjaz · 2019-06-05T12:42:08Z

@jelly thanks! Could you please also add a changelog fragment to this folder: https://github.com/ansible/ansible/tree/devel/changelogs/fragments

It's explained @ https://docs.ansible.com/ansible/devel/community/development_process.html#creating-a-changelog-fragment

This has been addressed

webknjaz

Waiting for the changelog fragment #55396 (comment) and docs review

jelly · 2019-06-05T13:35:24Z

@jelly thanks! Could you please also add a changelog fragment to this folder: https://github.com/ansible/ansible/tree/devel/changelogs/fragments

It's explained @ https://docs.ansible.com/ansible/devel/community/development_process.html#creating-a-changelog-fragment

Ok, added one, hope I did it correctly!

Make Git module support `--valid-pgpkeys` option, which allows configuring a list of valid PGP fingerprints which are compared with the used PGP fingerprint if verify_commit is true. This requires verify_commit to be set to 'yes'. Signed-off-by: Jelle van der Waa <jelle@vdwaa.nl>

webknjaz · 2019-06-05T18:09:50Z

I've polished the message a bit

webknjaz · 2019-06-05T18:19:08Z

Thanks @jelly for the patch and @acozine for the docs review!

jelly force-pushed the valid_pgpkeys branch from 36a573b to 67668c8 Compare April 16, 2019 19:50

ansibot added needs_revision This PR fails CI tests or a maintainer has requested a review/revision of the PR. and removed core_review In order to be merged, this PR must follow the core review workflow. labels Apr 16, 2019

eli-schwartz suggested changes Apr 16, 2019

View reviewed changes

lib/ansible/modules/source_control/git.py Outdated Show resolved Hide resolved

lib/ansible/modules/source_control/git.py Show resolved Hide resolved

lib/ansible/modules/source_control/git.py Outdated Show resolved Hide resolved

mattclay added the ci_verified Changes made in this PR are causing tests to fail. label Apr 17, 2019

ansibot removed the needs_triage Needs a first human triage before being processed. label Apr 17, 2019

jelly force-pushed the valid_pgpkeys branch from 67668c8 to 1e212d1 Compare April 17, 2019 07:49

ansibot removed the ci_verified Changes made in this PR are causing tests to fail. label Apr 17, 2019

ansibot added stale_ci This PR has been tested by CI more than one week ago. Close and re-open this PR to get it retested. stale_review Updates were made after the last review and the last review is more than 7 days old. labels Apr 25, 2019

mkrizek requested a review from webknjaz June 3, 2019 13:26

webknjaz previously requested changes Jun 3, 2019

View reviewed changes

jelly force-pushed the valid_pgpkeys branch from 1e212d1 to add57eb Compare June 5, 2019 12:27

ansibot removed stale_ci This PR has been tested by CI more than one week ago. Close and re-open this PR to get it retested. stale_review Updates were made after the last review and the last review is more than 7 days old. labels Jun 5, 2019

webknjaz reviewed Jun 5, 2019

View reviewed changes

lib/ansible/modules/source_control/git.py Outdated Show resolved Hide resolved

webknjaz reviewed Jun 5, 2019

View reviewed changes

lib/ansible/modules/source_control/git.py Outdated Show resolved Hide resolved

webknjaz assigned acozine Jun 5, 2019

webknjaz reviewed Jun 5, 2019

View reviewed changes

jelly force-pushed the valid_pgpkeys branch from add57eb to b6e1fdd Compare June 5, 2019 13:33

ansibot added the support:community This issue/PR relates to code supported by the Ansible community. label Jun 5, 2019

This comment has been minimized.

Sign in to view

ansibot added the ci_verified Changes made in this PR are causing tests to fail. label Jun 5, 2019

jelly force-pushed the valid_pgpkeys branch from b6e1fdd to e775a4e Compare June 5, 2019 13:59

ansibot removed the ci_verified Changes made in this PR are causing tests to fail. label Jun 5, 2019

jelly force-pushed the valid_pgpkeys branch from e775a4e to 2df30bc Compare June 5, 2019 16:10

jelly force-pushed the valid_pgpkeys branch from 2df30bc to 00d7d49 Compare June 5, 2019 16:22

webknjaz approved these changes Jun 5, 2019

View reviewed changes

Improve the changelog fragment style

56ebabc

webknjaz changed the title ~~Support --valid_pgpkeys option in Git module~~ Support --valid_pgpkeys option in Git module () Jun 5, 2019

webknjaz merged commit 7a3914b into ansible:devel Jun 5, 2019

jelly deleted the valid_pgpkeys branch June 5, 2019 19:27

ansible locked and limited conversation to collaborators Aug 5, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support `--valid_pgpkeys` option in Git module () #55396

Support `--valid_pgpkeys` option in Git module () #55396

jelly commented Apr 16, 2019 •

edited by webknjaz

jelly commented May 6, 2019

webknjaz left a comment

webknjaz commented Jun 5, 2019 •

edited

webknjaz left a comment

jelly commented Jun 5, 2019

This comment has been minimized.

webknjaz commented Jun 5, 2019

webknjaz commented Jun 5, 2019

Support --valid_pgpkeys option in Git module () #55396

Support --valid_pgpkeys option in Git module () #55396

Conversation

jelly commented Apr 16, 2019 • edited by webknjaz

SUMMARY

ISSUE TYPE

COMPONENT NAME

ADDITIONAL INFORMATION

jelly commented May 6, 2019

webknjaz left a comment

Choose a reason for hiding this comment

webknjaz commented Jun 5, 2019 • edited

webknjaz left a comment

Choose a reason for hiding this comment

jelly commented Jun 5, 2019

This comment has been minimized.

webknjaz commented Jun 5, 2019

webknjaz commented Jun 5, 2019

Support `--valid_pgpkeys` option in Git module () #55396

Support `--valid_pgpkeys` option in Git module () #55396

jelly commented Apr 16, 2019 •

edited by webknjaz

webknjaz commented Jun 5, 2019 •

edited