Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Fix Ansible in rule ensure_redhat_gpgkey_installed
We have discovered that in some Ansible Playbooks that we generate, for example in `rhel8-playbook-anssi_bp28_high.yml`, the remediation for rule `ensure_redhat_gpgkey_installed` doesn't ensure that Red Hat GPG key is installed. Specifically, the Ansible Task `Import RedHat GPG key` is skipped during the Playbook execution because the condition `(gpg_installed_fingerprints | difference(gpg_valid_fingerprints)) | length == 0` that is part of the `when` statement in that task is evaluated as `false`. The root cause is that the `gpg_installed_fingerprints` fact is a list but the `gpg_valid_fingerprints` is a tuple. Starting from Ansible 2.16, the `difference` filter changed behavior when its operands are each of a different type. Therefore a list of different items of a non-zero length is produced. An easy fix to this is to define both aforementioned facts as same data types, eg. lists. Fixes: ComplianceAsCode#11399, ComplianceAsCode#11409
- Loading branch information