Fixes the action plugin mkdtemp and expand_user calls to fallback to the
original non-pipelined variants when a connection plugin does not
support pipelining. For example a 3rd party Windows connection plugin
may not support pipelining and thus cannot use the user _mkdtemp2 and
_expand_user2 variants exposed by the `powershell` shell plugin as they
require data to be sent over stdin.
* Raise warning on inaccessible path (#57573)
* Raise error on permission denied (#57573)
* Use `os.lstat` for all state operations in `file`
* Update warning messages
* Update changelog
* Make tests use remote_tmp_dir for easier cleanup
* Rename and update changelog fragment
* Tweak changelog fragment
---------
Co-authored-by: Jakub Pieńkowski <8525083+Jakski@users.noreply.github.com>
* ansible-galaxy - only install/download collections with compatible requires_ansible metadata
inject requires_ansible as a dependency of the collection
add a hack to preserve the collection origin in the error message in get_dependencies and find_matches
* yield requires_ansible requirement before dependencies
* Fix error handling and broken test
Fix getting requires_ansible dependency after the metadata is available
Allow 3rd party servers to provide this metadata lazily for individual versions
Rename the candidate attr name for the error handling hack
* fix diff
* clarify code comments
refactor a bit
* Don't duplicate error message. Before:
[ERROR]: Failed to resolve the requested dependencies map. Could not satisfy the following requirements:
* ns.col2:1.0.0 (dependency of ns.col3:1.0.0) requires ansible-core <2.19.1
Hint: To disregard whether the collection supports the current version of ansible-core, configure COLLECTIONS_ON_ANSIBLE_VERSION_MISMATCH as "ignore".
Hint: Pre-releases hosted on Galaxy or Automation Hub are not installed by default unless a specific version is requested. To enable pre-releases globally, use --pre: [RequirementInformation(requirement=<ansible-core:<2.19.1 of type 'requires_ansible' from Galaxy>, parent=<ns.col2:1.0.0 of type 'galaxy' from cmd_arg>)]
Failed to resolve the requested dependencies map. Could not satisfy the following requirements:
* ns.col2:1.0.0 (dependency of ns.col3:1.0.0) requires ansible-core <2.19.1
Hint: To disregard whether the collection supports the current version of ansible-core, configure COLLECTIONS_ON_ANSIBLE_VERSION_MISMATCH as "ignore".
Hint: Pre-releases hosted on Galaxy or Automation Hub are not installed by default unless a specific version is requested. To enable pre-releases globally, use --pre.
<<< caused by >>>
[RequirementInformation(requirement=<ansible-core:<2.19.1 of type 'requires_ansible' from Galaxy>, parent=<ns.col2:1.0.0 of type 'galaxy' from cmd_arg>)]
After:
[ERROR]: Failed to resolve the requested dependencies map. Could not satisfy the following requirements:
* ns.col2:1.0.0 (dependency of ns.col3:1.0.0) requires ansible-core <2.19.1
Hint: To disregard whether the collection supports the current version of ansible-core, configure COLLECTIONS_ON_ANSIBLE_VERSION_MISMATCH as "ignore".
Hint: Pre-releases hosted on Galaxy or Automation Hub are not installed by default unless a specific version is requested. To enable pre-releases globally, use --pre.
* appease CI
fix type hints
* Update changelogs/fragments/install-ansible-core-compatible-collections.yml
Co-authored-by: sivel / Matt Martz <matt@sivel.net>
* Hardcode unsupported requires_ansible version to make maintaining the tests easier
Add a test for failed backtracking
Co-authored-by: sivel / Matt Martz <matt@sivel.net>
---------
Co-authored-by: sivel / Matt Martz <matt@sivel.net>
* Fix vaulted value rendering
- Fixes AnsibleDumper works on vaulted strings
- Adds config setting for opting in to future forced-strictness
* Add tests for new to_yaml functionality
* Add return on all paths
* Clarify configured value name
* Fix sanity (remove unused import)
* Catch more cases of encrypted strings
* WIP fix failing unit tests
* Update unit test to work with new to_yaml features
* Remove unit test
Running coverage with/without shows no new coverage.
* Write some basic error text
* Fix tests for error configuration
* Change names
- Change `vault_behavior` to just `vault`
- Change `preserve` to `keep_encrypt`
* Fix small issues in tests
* Fix fmt with black
* Fix unit tests
- Fix imports
- Fix the name of the param
* Update assorted docs - code review
Co-authored-by: Abhijeet Kasurde <akasurde@redhat.com>
* Remove deprecation
* Simplify vault parameter and handling
- Get rid of `default` enum
- Get rid of config option and associated test file
- Change `vault` to `vault_behavior`
* Document filter parameter
* Correctly Document filter parameter
* Add version_added and changelog fragment
* Tweak changelog
* Remove dead code, add docstring
* Add bugfixes section to changelog
Co-authored-by: Matt Davis <6775756+nitzmahone@users.noreply.github.com>
---------
Co-authored-by: Abhijeet Kasurde <akasurde@redhat.com>
Co-authored-by: Matt Davis <6775756+nitzmahone@users.noreply.github.com>
* Replace gpg in rpm_key with librpm
* Manually compute primary key ID and fingerprint for older librpm
* Code cleanup
* Add some v6 tests
* Add rhel 10.1 to CI matrix and changelog
* Remove RHEL 10.0
* consolidate common code and rename unused vars
* remove unnecessary exception raise
* Fix return type
* review comments: change import and use of Optional
* ci_complete ci_coverage
* address review comments
* When checking for existing keys, account for short from key ID and revert test change that hid this
* Support RPM version 6+. Allow 'key' to be fingerprint.
* Replace v6 test key with non-PQC algo version and enable Fedora v6 tests
* modify changelog, mod doc, and del 10.1 test req
* Code refactor and new tests
Refactor code to not need to use librpm API to get list of installed
keys. Also add new tests to verify deleting by fingerprint.
* Refactor drop_key() by rpm version, fully type hint code
* use hexdigest()
* Add PowerShell 7 support
Add support for running PowerShell modules cross platform and with
PowerShell 7. Tidies up some PowerShell shell plugin methods to make
it more reflective of the target shell vs a shell used for Windows.
Currently only Windows is officially supported with a plan on adding
tests and official support for non-Windows platforms at a later date.
ci_complete
* Fix pslint sanity issues
* Fix up typos
* Update lib/ansible/plugins/connection/psrp.py
Co-authored-by: Brian Scholer <1260690+briantist@users.noreply.github.com>
* Add note about relative symlink
* Use TracebacksFor instead of Verbosity for debug info
* Use proper powershell name in CI script
* Remove extra ansible-test changes leftover from rebase
---------
Co-authored-by: Brian Scholer <1260690+briantist@users.noreply.github.com>
Fix network module failures on tagged RPC responses
* Zap tags in networking JsonRpcServer before pickling responses.
* Verify with unit test - suboptimal, but avoids a fake network connection plugin.
On some Windows hosts the TLS policies don't allow TLS 1.2 or newer by
default. We add some code to the bootstrapping code to enable PowerShell
to use the OS policies rather than the outdated .NET ones.
This has only appeared on Azure 2016 based hosts, AWS on 2016 seems to
configure the server to use the OS policies some other way. 2019+ by
default aren't affected.
* package_facts: Use apk query instead of apk info to gather facts
* ``apk query`` gives more options to gather facts than ``apk info``
Fixes: #86579
Signed-off-by: Abhijeet Kasurde <Akasurde@redhat.com>
The user module's 'groups' return value was returning the groups
specified in the module input rather than the actual groups the
user belongs to on the system. When using append=true, this meant
pre-existing groups were missing from the output.
Now queries the system for the user's actual group membership after
modification, which matches the documented behavior of "List of
groups of which the user is a member."
Fixes#80669
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
RETURN_VARS was introduced for #70331, and last used in #70853.
# git grep RETURN_VARS | wc -l
1
Remove it.
Signed-off-by: Ariel Otilibili <a.otilibili@instadeep.com>
* user - Preserve current password when modifying user on BusyBox systems
A bug in _build_password_string would incorrectly change the password hash
to ‘*’ if no password was specified.
* Update tests
Add a task to unsure the password is preserved when the password is not specified.
Use correct value when inspecting the password hash from the shadow data.
* Add changelog
Fix user modification on Alpine. This change will handle primary group, shell, and password changes. It does not handle expiration changes, though it probably could with a bit more work.
The Alpine documentation recommends manually editing /etc/password to change the shell. These changes will rewrite the /etc/passwd file using atomic_move but creates a backup beforehand.
* deb822_repository: validate name parameter instead of over-normalizing
The deb822_repository module was silently mangling the name parameter by converting to lowercase, replacing underscores with hyphens, and removing other characters. This caused filename collisions where distinct repository names produced identical filenames.
This change validates that the name parameter contains only valid APT sources.list filename characters (a-zA-Z0-9_.-) and preserves the name as-is. Invalid characters now result in a clear error message.
Fixes: #86243
* fix: update install.yml test to use valid name without spaces
* deb822_repository: add backward compatibility for legacy filenames
Check if a file with the old normalized naming convention already exists before using the new naming. If a legacy file exists, reuse that slug to avoid creating duplicate files for the same repository.
This addresses feedback from #86343 to maintain backward compatibility.
* deb822_repository: adopt PR #86343 approach for backward compatibility
Based on maintainer feedback, removed strict validation that hard-failed on invalid characters. Instead:
- Convert spaces to hyphens (backward compatible with existing playbooks)
- Preserve case, underscores, and periods
- Check for legacy-normalized files and reuse them if they exist
This maintains backward compatibility while still avoiding over-normalization.
Addresses feedback from https://github.com/ansible/ansible/pull/86494#discussion_r1975816493
* Replicate PR #86343 structure and fix trailing whitespace
- Created name_handling.yml with exact tests from #86343
- Import name_handling.yml in main.yml
- Removed conflicting tests from test.yml
- Updated changelog to match #86343 format
- Fixed trailing whitespace on line 584 (pep8/pylint fix)
* Apply suggested change: inline name.replace() directly
* Fix discrepancy between ansible-galaxy and ansible runtime when identifying usable collections
When enumerating usable collections, ansible-galaxy validates the galaxy metadata in the MANIFEST.json/galaxy.yml matches the collection path.
When the metadata is incorrect ansible-galaxy emits a warning and falls back to using no metadata since it is not required for usable collections.
* ansible-galaxy collection verify now evaluates the collection that will be used at runtime, even if a collection inaccurately documents the same namespace and name earlier in the search path
* Add integration tests for ansible-galaxy collection verify, list, and install
Changes the logic used by `Ansible.ModuleUtils.AddType` to only include
the debug information when `DISPLAY_TRACEBACKS` is set to `error` or
`always`. This aligns with the new logic that no longer uses the
verbosity level to include extra traceback information with higher
verbosities.
The local connection plugin is incorrectly passing a bytearray to methods of become plugins that expect bytes. A recent change to the su plugin exposed this by breaking the become plugin for different locale settings (the bytearray was not properly converted to a str for comparison operations). This changes the local connection plugin to send bytes.
Fix the output of git checkmode when supplied with a nonexistent ref for the version parameter.
Uses git fetch --dry-run [ref] to check if the supplied ref actually exists.
PR #86461.
Prior to this patch, the core packaging metadata contained relative contributing and license file URLs in its description field, which is sourced from the `README.md` file. These URLs are relative to the website location they're rendered in. On GitHub, they'd point to neighboring files in the repository but PyPI does not host them and this makes relative URLs point to addresses on PyPI that do not exist.
The change updates the lin URLs to be absolute and point to the file views in the GitHub repository, which fixes#86460.
Co-authored-by: 🇺🇦 Sviatoslav Sydorenko (Святослав Сидоренко) <webknjaz@redhat.com>
