Skip to content

Commit

Permalink
Fix Ansible in rule ensure_redhat_gpgkey_installed
Browse files Browse the repository at this point in the history
We have discovered that in some Ansible Playbooks that we generate, for example
in `rhel8-playbook-anssi_bp28_high.yml`, the remediation for rule
`ensure_redhat_gpgkey_installed` doesn't ensure that Red Hat GPG key is
installed.

Specifically, the Ansible Task `Import RedHat GPG key`
is skipped during the Playbook execution because the condition
`(gpg_installed_fingerprints | difference(gpg_valid_fingerprints)) | length == 0`
that is part of the `when` statement in that task is evaluated as `false`.
The root cause is that the `gpg_installed_fingerprints` fact is a list
but the `gpg_valid_fingerprints` is a tuple. Starting from Ansible 2.16,
the `difference` filter changed behavior when its operands are each
of a different type. Therefore a list of different items of a non-zero
length is produced. An easy fix to this is to define both aforementioned facts
as same data types, eg. lists.

Fixes: ComplianceAsCode#11399, ComplianceAsCode#11409
  • Loading branch information
jan-cerny committed Jan 3, 2024
1 parent d15e2fe commit f0e38a3
Showing 1 changed file with 3 additions and 1 deletion.
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,9 @@

- name: Set Fact - Valid fingerprints
set_fact:
gpg_valid_fingerprints: ("{{{ release_key_fingerprint }}}" "{{{ auxiliary_key_fingerprint }}}")
gpg_valid_fingerprints:
- "{{{ release_key_fingerprint }}}"
- "{{{ auxiliary_key_fingerprint }}}"

- name: Import RedHat GPG key
rpm_key:
Expand Down

0 comments on commit f0e38a3

Please sign in to comment.