support add repo behind proxy on ubuntu(#42534) #42536
Conversation
|
I actually have both https_proxy and no_proxy in the code, had to took them out pretty quickly, because they are not supported options, see error message below if you pass them in from --keyserver-options: below are my speculation due to the lack of documentation on keyserver-options:
|
|
I’d rather go the way of fixing low level tools to make them respect proxy
env vars. Otherwise every apt-related module tends to be a bundle of
workarounds for random edge cases.
|
|
Hi @sashka Agreed changing underlining system tools can fix this problem without Ansible code change. But this means an upgrade of these system package/s will be required, which might not be desired in all situations for obvious reasons. On the other hand, this change will fix the problem. I can see why you consider it a workaround for random edge case, but I would suggest it's a fix for an Ansible bug, which render apt_key and apt_repository modules broken for Ubuntu behind proxy. Unless there is a better approach available. Furthermore, the changes are in Ansible implementation details and not exposed to user. This is the precise reason one would use Ansible or an alternative for: Ansible handles the edge cases and workarounds, keep the playbook plain and simple. some relevant information and documentations:
I am not openpgp expert, but what i get is
does not look like one can pass in honor-http-proxy at apt-key level. Also tried to update config files in ~/.gnupg folder, didn't work. So two other possible solution:
Both of them requires changes in apt-key or replace/rewrite it all together in apt_key and apt_repository modules, which sounds like overkill for me, and will also introduce future maintenance issues. |
|
The test |
|
@sashka @hangsu-ma in respect to the "all apt modules have to carry a work around", would it make sense to create an |
|
I had the same issue on ubuntu 18.04; here's another version that uses less regex and more standard libraries: https://gist.github.com/bebosudo/91837eec70b3d06a9278b3c9ae5289f1 Edit: Updated script to work on py2 ( |
|
@hangsu-ma The following file(s) in this pull request are bundled copies of modules used to support incidental tests and should not be updated:
Because the original module(s) have been migrated to collections, please re-submit this pull request in relevant collection repositories, typically under https://github.com/ansible-collections. If you need further assistence with identifying the correct repository, please stop by IRC or the mailing list:
|
ansibot
added
needs_revision
core_review
and removed
core_review
stale_ci
needs_revision
labels
So that the caller can determine if proxy settings should be applied. Supports most common form of no_proxy listed below: 1. no_proxy is a comma separated list of one or more items below 2. full domain name or hostname 3. containing * wildcard. example: *.example.com 4. leading or trailing dot (.). example: 192.168.56. 5. subnet range. example: 192.168.23.0/24 NOTE: no DNS look up is carried out
Similar reason behind ansible#42443 apt_repository module calls apt-key to add new repo source on ubuntu. apt-key does not respect Acquire::http::Proxy specified in apt conf files, nor http_proxy environment variable. More discussion about these behaviours can be found here: https://bugs.launchpad.net/ubuntu/+source/software-properties/+bug/1433761 keyserver-options are used to pass in proxy settings for apt-key, example: sudo apt-key adv --keyserver-options http-proxy=http://username:password@proxy.example.com:8080 --keyserver keyserver.ubuntu.com --recv-keys GPG_KEY This fix parse http_proxy and no_proxy environment variables and pass on proxy to apt-key using --keyserver-options if ubuntu key server is not in no_proxy list.
|
Ping? Just ran into this issue myself. |
|
Since apt-key is deprecated, bigger picture, we probably need to fix the underlying module to directly fetch the keys, eg: https://www.linuxuprising.com/2021/01/apt-key-is-deprecated-how-to-add.html - if we used fetch_url to do this, the system proxy config would be respected "for free". |
|
Any plan to fix this issue ? The apt_repository module is still broken since 2018 (#42534). The last comment from @nitzmahone in the issue #42534 is misleading. apt-key is called without the proxy option. |
SUMMARY
Fixes #42534
Similar reason behind #42443
apt_repository module calls apt-key to add new repo source on ubuntu.
apt-key does not respect http_proxy environment variable.
As a result, one would thought adding http_porxy env var using environment
will be sufficient, which is never the case and apt_repository will always fail
to add new repo behind proxy on ubuntu.
keyserver-options are used to pass in proxy settings for apt-key, example:
sudo apt-key adv --keyserver-options http-proxy=http://username:password@proxy.example.com:8080 --keyserver keyserver.ubuntu.com --recv-keys GPG_KEY
This fix read http_proxy environment variable and pass it on to apt-key using --keyserver-options.
ISSUE TYPE
COMPONENT NAME
apt_repository
ANSIBLE VERSION
ADDITIONAL INFORMATION