# Dnf module mangles package name of downloaded RPM

**URL:** <https://forum.ansible.com/t/dnf-module-mangles-package-name-of-downloaded-rpm/5161>\
**Category:** Get Help\
**Tags:** module, playbook\
**Created:** [April 25, 2024, 8:11pm UTC](https://forum.ansible.com/t/dnf-module-mangles-package-name-of-downloaded-rpm/5161 "2024-04-25T20:11:21Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![guertin](https://avatars.discourse-cdn.com/v4/letter/g/ed8c4c/32.png) [@guertin](https://forum.ansible.com/u/guertin)\
**Post date:** [April 25, 2024, 8:11pm UTC](https://forum.ansible.com/t/dnf-module-mangles-package-name-of-downloaded-rpm/5161/1 "2024-04-25T20:11:21Z")

</div>

I’ve got the following code to download and install an RPM package on a Linux server:

```auto
- name: Install Foreman repository
  become: true
  ansible.builtin.dnf:
  ¦ name: "https://yum.theforeman.org/releases/latest/el{{ osrel | trim }}/x86_64/foreman-release.rpm"
  ¦ state: present

```

It works as far as downloading the package, but the installation fails with a GPG check error:

```auto
FAILED! => {"changed": false, "msg": "Failed to validate GPG signature for foreman-release-3.10.0-1.el8.noarch: Public key for foreman-releaseyvnup2j9.rpm is not installed"}

```

I don’t know where `foreman-releaseyvnup2j9.rpm` is coming from, but it’s different with each run. For example, running it again fails to find a key for `foreman-releasetimtkhr2.rpm`.

Running dnf from the command line outside of Ansible works as expected.

I could just work around the problem by adding `disable_gpg_check: true`, but I’d rather not do that. Can anyone tell me why this is not using the correct package name when doing the GPG check?

---

<div class="post-metadata">

**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\
**Post date:** [April 25, 2024, 9:28pm UTC](https://forum.ansible.com/t/dnf-module-mangles-package-name-of-downloaded-rpm/5161/2 "2024-04-25T21:28:20Z")

</div>

The issue has nothing to do with mangling of the filename. You’ll want to review this issue comment for the reason [disparity between dnf module and dnf os command · Issue #80720 · ansible/ansible · GitHub](https://github.com/ansible/ansible/issues/80720#issuecomment-1535316470)

or ensure you’ve installed the gpg key used to sign that package so it can be verified

---

<div class="post-metadata">

**Author:** ![evgeni](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/evgeni/32/2686_2.png) [@evgeni](https://forum.ansible.com/u/evgeni)\
**Post date:** [April 30, 2024, 3:07pm UTC](https://forum.ansible.com/t/dnf-module-mangles-package-name-of-downloaded-rpm/5161/3 "2024-04-30T15:07:25Z")

</div>

That particular package _contains_ the GPG key, so it’s a bit of chicken and egg (you could install it via other means, sure).  
But (with my Foreman hat on), pulling that RPM via an HTTPS connection should be fine w/o checking GPG.  
That’s also what we’re doing in the official collection:

> <https://github.com/theforeman/foreman-operations-collection/blob/ba26985066eeecc36adb5676eb8e7dffc5528e61/roles/foreman_repositories/tasks/redhat.yml#L3-L6>

---

<div class="post-metadata">

**Author:** ![guertin](https://avatars.discourse-cdn.com/v4/letter/g/ed8c4c/32.png) [@guertin](https://forum.ansible.com/u/guertin)\
**Post date:** [April 30, 2024, 6:20pm UTC](https://forum.ansible.com/t/dnf-module-mangles-package-name-of-downloaded-rpm/5161/4 "2024-04-30T18:20:58Z")

</div>

Thanks. That’s what I’ll do. Not that it really matters, but I’m still just curious though where the `foreman-releaseyvnup2j9.rpm` stuff is coming from.

---

<div class="post-metadata">

**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\
**Post date:** [April 30, 2024, 6:28pm UTC](https://forum.ansible.com/t/dnf-module-mangles-package-name-of-downloaded-rpm/5161/5 "2024-04-30T18:28:16Z")

</div>

You could install the key directly first, and then install the release rpm. The mangled filename might be incidental, but if you want to make sure the signature is good, then install the key first like so:

```yaml
- name: Import Foreman key
  ansible.builtin.rpm_key:
    state: present
    key: "https://yum.theforeman.org/releases/{{ foreman_repositories_version }}/RPM-GPG-KEY-foreman"

```

---

<div class="post-metadata">

**Author:** ![evgeni](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/evgeni/32/2686_2.png) [@evgeni](https://forum.ansible.com/u/evgeni)\
**Post date:** [April 30, 2024, 6:53pm UTC](https://forum.ansible.com/t/dnf-module-mangles-package-name-of-downloaded-rpm/5161/6 "2024-04-30T18:53:08Z")

</div>

> [@guertin](#):
>
> Not that it really matters, but I’m still just curious though where the `foreman-releaseyvnup2j9.rpm` stuff is coming from.

I guess Ansible first downloads that file to some temp location (so it can compare “is it installed already” and properly report `changed`), and during that it also gives it a “temp” name. Given rpm/yum/dnf will use the name from the RPM header, the filename doesn’t matter much anyway.

> [@Denney-tech](#):
>
> You could install the key directly first, and then install the release rpm. The mangled filename might be incidental, but if you want to make sure the signature is good, then install the key first like so:
> 
> ```auto
> - name: Import Foreman key
> ansible.builtin.rpm_key:
> state: present
> key: https://yum.theforeman.org/releases/latest/RPM-GPG-KEY-foreman
> 
> ```

How would that improve the security of the “obtain the key” operation, given you’re still fetching the same key from the same host (well, CDN, but whatever)?

The signature will then be checked when you actually install packages from that repository.

---

<div class="post-metadata">

**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\
**Post date:** [April 30, 2024, 7:10pm UTC](https://forum.ansible.com/t/dnf-module-mangles-package-name-of-downloaded-rpm/5161/7 "2024-04-30T19:10:25Z")

</div>

I suppose that if the rpm is compromised by the same signing key found in the repo, the security is moot. If specific parts of the supply chain are somehow compromised, but also somehow the key is not, then we at least move the chicken and egg problem around to catch that. 🤷‍♂️

Including the fingerprint from a trusted source would solve this, but I’m not sure of a reliable/programmatic way of doing that.

There’s these: [Index of /static/keys (theforeman.org)](https://theforeman.org/static/keys/), but you would have to find exactly which one you need.

Here’s a table of which fingerprint keys are for which release: [Foreman :: Security (theforeman.org)](https://theforeman.org/security.html#GPGkeys)

Edit: So something like:

```yaml
- name: Import Foreman key
  vars:
    foreman_repositories_version: "3.10"
    foreman_repositories_version_fingerprint: "63B3 8BE5 1B2D DDAF F7EF 7EC9 0A8F 8D40 93DD 1D0C"
  ansible.builtin.rpm_key:
    state: present
    key: "https://yum.theforeman.org/releases/{{ foreman_repositories_version }}/RPM-GPG-KEY-foreman"
    fingerprint: "{{ foreman_repositories_version_fingerprint }}"

```

---

<div class="post-metadata">

**Author:** ![chris](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/chris/32/293_2.png) [@chris](https://forum.ansible.com/u/chris)\
**Post date:** [May 1, 2024, 12:45pm UTC](https://forum.ansible.com/t/dnf-module-mangles-package-name-of-downloaded-rpm/5161/8 "2024-05-01T12:45:47Z")

</div>

> [@evgeni](#):
>
> How would that improve the security of the “obtain the key” operation, given you’re still fetching the same key from the same host (well, CDN, but whatever)?

For situations like this I have the checksum of the key saved so that there is an error if it differs.

For example see [this vars/mail.yml](https://git.coop/webarch/icinga/-/blob/master/vars/main.yml?ref_type=heads#L22) file and [the task that downloads the GPG key](https://git.coop/webarch/icinga/-/blob/master/tasks/apt.yml?ref_type=heads#L34).

This is in addition to having [GPG fingerprints saved](https://git.coop/webarch/icinga/-/blob/master/vars/main.yml?ref_type=heads#L26) and [checking the fingerprints](https://git.coop/webarch/icinga/-/blob/master/tasks/apt.yml?ref_type=heads#L81).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [May 31, 2024, 12:46pm UTC](https://forum.ansible.com/t/dnf-module-mangles-package-name-of-downloaded-rpm/5161/9 "2024-05-31T12:46:40Z")

</div>

Closed on May 31, 2024, 12:46pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.