Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[maintenance_11_debian] False positive for missing security repos #65

Open
4censord opened this issue Jul 18, 2024 · 1 comment
Open
Assignees

Comments

@4censord
Copy link

4censord commented Jul 18, 2024

While running adfinis.maintenance.maintenance_11_debian against a debian 12 (bookworm) host,
the role complains about missing security repos.

TASK [adfinis.maintenance.maintenance_11_debian : 11-011: Security: Are the security updates in the sources.list?] ********************************************************************************************************************************************
changed: [...] => {
    "assertion": "ansible_facts.apt_sources | selectattr('uri', 'eq', debian_sources_list_security_uri) | selectattr('suites', 'contains', debian_sources_list_security_suite) | selectattr('types', 'contains', 'deb') | selectattr('components', 'contains', 'main') | length > 0",
    "changed": true,
    "evaluated_to": false,
    "failed_when_result": false,
    "msg": "debian-security repository missing: deb http://security.debian.org/debian-security bookworm-security main"
}

But, when looking at the sources these are present:

$ cat /etc/apt/sources.list.d/debian.sources
Types: deb deb-src
URIs: mirror+file:///etc/apt/mirrors/debian.list
Suites: bookworm bookworm-updates bookworm-backports
Components: main

Types: deb deb-src
URIs: mirror+file:///etc/apt/mirrors/debian-security.list
Suites: bookworm-security
Components: main
$ cat /etc/apt/mirrors/debian-security.list 
https://deb.debian.org/debian-security
@s3lph
Copy link
Collaborator

s3lph commented Jul 19, 2024

As a quick workaround you can set debian_sources_list_security_uri: mirror+file:///etc/apt/mirrors/debian-security.list. Unfortunately, this won't audit the contents of that mirrorlist file. So we should probably also include special handling for the mirror+file URI schema in adfinis.facts.apt_sources_facts

@s3lph s3lph self-assigned this Jul 19, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants