Binary GnuPG keys downloaded by 'ansible.builtin.apt_key' were corrupted

[maximmasiutin]

SUMMARY

When importing a key by the apt_key module, it gets corrupted and not imported in the case of a binary key (not a textual “armored” key). Ansible tries to convert string data, but some data is lost on conversion, which results in a GnuPG error. This is a bug because binary data should not be converted using the to_native function.

ISSUE TYPE

• Bugfix Pull Request

COMPONENT NAME

ansible.builtin.apt_key module

ADDITIONAL INFORMATION

Fixes #74424

Augmented by #74483

To reproduce this error, create the following files:

Fie Vagrantfile file:

Vagrant.configure("2") do |config|
  config.vm.base_mac = nil
  config.vm.synced_folder ".", "/vagrant", disabled: false

  config.vm.define "test-host" do |n|
    n.vm.box = "ubuntu/bionic64"
    n.vm.hostname = "test-host"
    n.vm.provision :ansible do |ansible|
      ansible.limit = "all"
      ansible.playbook = "test.yaml"
    end
  end
end

The test.yaml file:

- name: Test Playbook
  hosts: test-host
  become: yes
  tasks:
    - name: Add binary key
      apt_key: url=https://packages.cloud.google.com/apt/doc/apt-key.gpg
      register: apt_key_binary_test

    - name: Validate the results
      assert:
        that:
          - 'apt_key_binary_test.changed is defined'
          - 'apt_key_binary_test.changed'

and run vagrant up

Expected Results:

Key imported without a problem

Actual Results:

fatal: [master]: FAILED! => {"changed": false, "msg": "Unable to extract key from '-'", "stderr": "gpg: WARNING: no command supplied.  Trying to guess what you mean ...\ngpg: [don't know]: invalid packet (ctb=0a)\n", "stderr_lines": ["gpg: WARNING: no command supplied.  Trying to guess what you mean ...", "gpg: [don't know]: invalid packet (ctb=0a)"], "stdout": "pub:-:2048:1:FEEA9169307EA071:1614614617:1677728521::-:\nuid:::::::::Rapture Automatic Signing Key (cloud-rapture-signing-key-2021-03-01-08_01_09.pub):\nsub:-:2048:1:AA42F36EE8BEEE0E:1614614617::::\npub:-:2048:1:8B57C5C2836F4BEB:1607040606:1670154510::-:\nuid:::::::::gLinux Rapture Automatic Signing Key (//depot/google3/production/borg/cloud-rapture/keys/cloud-rapture-pubkeys/cloud-rapture-signing-key-2020-12-03-16_08_05.pub) <glinux-team@google.com>:\nsub:-:2048:1:48419E688DD52AC0:1607040606::::\n", "stdout_lines": ["pub:-:2048:1:FEEA9169307EA071:1614614617:1677728521::-:", "uid:::::::::Rapture Automatic Signing Key (cloud-rapture-signing-key-2021-03-01-08_01_09.pub):", "sub:-:2048:1:AA42F36EE8BEEE0E:1614614617::::", "pub:-:2048:1:8B57C5C2836F4BEB:1607040606:1670154510::-:", "uid:::::::::gLinux Rapture Automatic Signing Key (//depot/google3/production/borg/cloud-rapture/keys/cloud-rapture-pubkeys/cloud-rapture-signing-key-2020-12-03-16_08_05.pub) <glinux-team@google.com>:", "sub:-:2048:1:48419E688DD52AC0:1607040606::::"]}

Relevant file:
lib/ansible/modules/apt_key.py

[maximmasiutin]

ready_for_review