Investigate improving security of Ansible get_url download using GPG signature verification

[andrew-m-leonard]

As part of improving the security of the supply chain and reproducible builds (adoptium/temurin-build#2522), I have investigated some of the Ansible playbooks which download dependencies using get_url from the internet. The risk of such downloads are:

• Are they malicious websites?
• Have the website content being tampered with?
• Has a man-in-the-middle intercepted?
  These equally apply to manually downloaded and stored Ansible content as well.

Currently get_url task for most(but not all) of the downloads uses a checksum. This is reasonable, assuming the accuracy of the checksum is assured? for example was the content manually downloaded actually tampered prior to checksum creation? We can't be sure it is from the origin, especially in man-in-the-middle, which could even tamper with checksum files when downloaded, to match tampered content.

Using GPG signatures is far more safe.
Currently Ansible does not provide a builtin way of using GPG sigs. So we would need to provide our own extension?

[Haroon-Khel]

Starting with the UNIX playbook, I will document the validation method of the downloaded packages

File	Validation method
Ant	Supplies a checksum, but no validation. Supplies a .asc file
Ant-contrib	Doesn't supply a checksum, but we have one in the playbooks
Autoconf	Doesn't supply a checksum, but we have one in the playbooks. Supplies a .sig file
cmake	Not sure but the playbooks have one. Supplies a PGP signature
expat	Doesn't supply a checksum, but we have one in the playbooks
zlib	Doesn't supply a checksum, but we have one in the playbooks. Supplies a gpg signature
IBM Java 8 for SLES (Link has expired )
Curl	Supplies a .asc file
GGC-4.8	Supplies a .sig file
GCC-7.5
GCC-9.3
Git	Supplies a .sign file
Gmake	Supplies a .sig
Maven	Checksum and validation .Supplies a .asc file
Nagios-Plugins	Checksum and validation but no gpg validation
Nagios Supporting Script
NNVidia CUDA toolkit
OpenSSL
Python3	Supplies a .asc file

[sxa]

The more of these we can validate the better, so adding good first issue for anyone that wants to start working on doing the validation for any in the table that are missing it currently.

[Haroon-Khel]

An issue has been raised with Ansible already about their support for gpg signature validation on downloads using their get_url module
ansible/ansible#69364

[sxa]

Related: #2553

[zdtsw]

for those using "get_url" if can be replaced by using "apt" "yum"or "package" module, we replace them. check is by default enabled in these modules.

[sxa]

for those using "get_url" if can be replaced by using "apt" "yum"or "package" module, we replace them. check is by default enabled in these modules.

But only if the artifact it's supplied in one of those formats. This should cover source tarball downloads etc. too.

[zdtsw]

for those using "get_url" if can be replaced by using "apt" "yum"or "package" module, we replace them. check is by default enabled in these modules.

But only if the artifact it's supplied in one of those formats. This should cover source tarball downloads etc. too.

sure! for the others like tarball, which cannot use module, we still need gpg to verify

[Haroon-Khel]

Closing as #2881 is merged