# ansible-galaxy and git verify-tag

**URL:** <https://forum.ansible.com/t/ansible-galaxy-and-git-verify-tag/36146>\
**Category:** Ansible Project\
**Tags:** galaxy-ng\
**Created:** [December 22, 2021, 4:33pm UTC](https://forum.ansible.com/t/ansible-galaxy-and-git-verify-tag/36146 "2021-12-22T16:33:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Michael\_Stroder](https://avatars.discourse-cdn.com/v4/letter/m/7ea924/32.png) [@Michael\_Stroder](https://forum.ansible.com/u/Michael_Stroder)\
**Post date:** [December 22, 2021, 4:33pm UTC](https://forum.ansible.com/t/ansible-galaxy-and-git-verify-tag/36146/1 "2021-12-22T16:33:18Z")

</div>

HI!

Is it possible to make ansible-galaxy invoke 'git verify-tag' with a locally configured GPG public key on tags specified as version: in requirements.yml?

Thx in advance for any hint.

Ciao, Michael.

---

<div class="post-metadata">

**Author:** ![Michael\_Stroder](https://avatars.discourse-cdn.com/v4/letter/m/7ea924/32.png) [@Michael\_Stroder](https://forum.ansible.com/u/Michael_Stroder)\
**Post date:** [December 22, 2021, 5:00pm UTC](https://forum.ansible.com/t/ansible-galaxy-and-git-verify-tag/36146/2 "2021-12-22T17:00:43Z")

</div>

Hmm, seems there is no such thing yet:

[https://github.com/ansible/proposals/issues/36](https://github.com/ansible/proposals/issues/36)

How does ansible users here deal with ansible collections/roles pulled from remote resources? Just trust that nobody tampered with the software repos?

As a work-around it would be possible for git-based resources to use

git clone ...  
git verify-tag ...

and then let ansible-galaxy load collections/roles from the locally pulled git repo.

Opinions?

Ciao, Michael.

---

<div class="post-metadata">

**Author:** ![Nico\_Kadel-Garcia](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/nico_kadel-garcia/32/9998_2.png) [@Nico\_Kadel-Garcia](https://forum.ansible.com/u/Nico_Kadel-Garcia)\
**Post date:** [December 22, 2021, 5:07pm UTC](https://forum.ansible.com/t/ansible-galaxy-and-git-verify-tag/36146/3 "2021-12-22T17:07:09Z")

</div>

> \> Is it possible to make ansible-galaxy invoke 'git verify-tag' with a  
> \> locally configured GPG public key on tags specified as version: in  
> \> requirements.yml?
> 
> Hmm, seems there is no such thing yet:
> 
> [https://github.com/ansible/proposals/issues/36](https://github.com/ansible/proposals/issues/36)
> 
> How does ansible users here deal with ansible collections/roles pulled  
> from remote resources? Just trust that nobody tampered with the software  
> repos?

For Red Hat based systems, I use RPMs. Fedora publishes some of them  
as SRPMs, and I've built up some wrappers to build them alongside the  
oversized bundle that is now "ansible". Bundling them individually  
allows some flexibility not available with the oversized "ansible"  
bundle: see [https://github.com/nkadel/ansiblerepo/](https://github.com/nkadel/ansiblerepo/) for my work.

---

<div class="post-metadata">

**Author:** ![Michael\_Stroder](https://avatars.discourse-cdn.com/v4/letter/m/7ea924/32.png) [@Michael\_Stroder](https://forum.ansible.com/u/Michael_Stroder)\
**Post date:** [December 22, 2021, 5:43pm UTC](https://forum.ansible.com/t/ansible-galaxy-and-git-verify-tag/36146/4 "2021-12-22T17:43:15Z")

</div>

Maybe my posting was not clear enough:  
I was not asking about GPG signatures of ansible itself or other software artefacts.

I was asking about how to check the git tag signature of ansible roles/collections specified in requirements.yml and retrieved by ansible-galaxy tool.

For example I tell users of Æ-DIR to invoke [1]:

ansible-galaxy install -r requirements.yml

The requirements.yml contains something like [2]:

- src: git+[https://code.stroeder.com/AE-DIR/ansible-ae-dir-server.git](https://code.stroeder.com/AE-DIR/ansible-ae-dir-server.git)  
&nbsp;&nbsp;&nbsp;version: v0.32.3  
&nbsp;&nbsp;&nbsp;name: aedir\_server

The git tags defined by version: are all signed locally. Thus it would be nice if ansible-galaxy could check the GPG signature against my GPG key installed before on the ansible controller.

I'd like to provide additional protection because the ansible roles run as root on the target. (Yes, I know very well that trusted distribution of GPG public keys used for signature verification is hard at scale.)

Ciao, Michael.

[1] [https://www.ae-dir.com/install.html#install](https://www.ae-dir.com/install.html#install)

[2] [https://code.stroeder.com/AE-DIR/ansible-example-site/src/branch/master/requirements.yml](https://code.stroeder.com/AE-DIR/ansible-example-site/src/branch/master/requirements.yml)