-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix Ansible in rule ensure_redhat_gpgkey_installed #11413
Conversation
We have discovered that in some Ansible Playbooks that we generate, for example in `rhel8-playbook-anssi_bp28_high.yml`, the remediation for rule `ensure_redhat_gpgkey_installed` doesn't ensure that Red Hat GPG key is installed. Specifically, the Ansible Task `Import RedHat GPG key` is skipped during the Playbook execution because the condition `(gpg_installed_fingerprints | difference(gpg_valid_fingerprints)) | length == 0` that is part of the `when` statement in that task is evaluated as `false`. The root cause is that the `gpg_installed_fingerprints` fact is a list but the `gpg_valid_fingerprints` is a tuple. Starting from Ansible 2.16, the `difference` filter changed behavior when its operands are each of a different type. Therefore a list of different items of a non-zero length is produced. An easy fix to this is to define both aforementioned facts as same data types, eg. lists. Fixes: ComplianceAsCode#11399, ComplianceAsCode#11409
Skipping CI for Draft Pull Request. |
This datastream diff is auto generated by the check Click here to see the full diffansible remediation for rule 'xccdf_org.ssgproject.content_rule_ensure_redhat_gpgkey_installed' differs.
--- xccdf_org.ssgproject.content_rule_ensure_redhat_gpgkey_installed
+++ xccdf_org.ssgproject.content_rule_ensure_redhat_gpgkey_installed
@@ -72,7 +72,9 @@
- name: Set Fact - Valid fingerprints
set_fact:
- gpg_valid_fingerprints: ("567E347AD0044ADE55BA8A5F199E2F91FD431D51" "6A6AA7C97C8890AEC6AEBFE2F76F66C3D4082792")
+ gpg_valid_fingerprints:
+ - 567E347AD0044ADE55BA8A5F199E2F91FD431D51
+ - 6A6AA7C97C8890AEC6AEBFE2F76F66C3D4082792
tags:
- CCE-80795-8
- CJIS-5.10.4.1 |
Code Climate has analyzed commit f0e38a3 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 58.5% (0.0% change). View more on Code Climate. |
/packit retest-failed |
1 similar comment
/packit retest-failed |
Automatus job fails because we run the test scenarios against a non-RHEL back end which is usually a CentOS container and there there are no Red Hat GPG keys, these keys are specific to RHEL. If you execute the Automatus tests against a RHEL 8 virtual machine back end the tests pass.
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you @jan-cerny for discovering this problem. I tested it and it works as expected.
We have discovered that in some Ansible Playbooks that we generate, for example in
rhel8-playbook-anssi_bp28_high.yml
, the remediation for ruleensure_redhat_gpgkey_installed
doesn't ensure that Red Hat GPG key is installed.Specifically, the Ansible Task
Import RedHat GPG key
is skipped during the Playbook execution because the condition(gpg_installed_fingerprints | difference(gpg_valid_fingerprints)) | length == 0
that is part of thewhen
statement in that task is evaluated asfalse
. The root cause is that thegpg_installed_fingerprints
fact is a list but thegpg_valid_fingerprints
is a tuple. Starting from Ansible 2.16, thedifference
filter changed behavior when its operands are each of a different type. Therefore a list of different items of a non-zero length is produced. An easy fix to this is to define both aforementioned facts as same data types, eg. lists.Fixes: #11399, #11409
Review Hints: