# User ownership for namespace is getting changed to a different user **URL:** \ **Category:** Get Help\ **Tags:** galaxy-ng\ **Created:** [October 2, 2023, 10:19pm UTC](https://forum.ansible.com/t/user-ownership-for-namespace-is-getting-changed-to-a-different-user/1361 "2023-10-02T22:19:55Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![lkiesow](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/lkiesow/32/941_2.png) [@lkiesow](https://forum.ansible.com/u/lkiesow)\ **Post date:** [October 2, 2023, 10:19pm UTC](https://forum.ansible.com/t/user-ownership-for-namespace-is-getting-changed-to-a-different-user/1361/1 "2023-10-02T22:19:55Z")
Not only have the namespaces changed, but some namespaces/roles/… now seem to have been transferred to other users. For example, the `elan.opencast_user` is the old name. But it now seems to belong to someone else: ![Screenshot from 2023-10-03 00-12-40](https://us1.discourse-cdn.com/ansible/original/1X/e452208d4afed4141abce020b37cb3ddf13073ee.png) This is also severe security risk since people can easily take over and execute a supply chain attack using this with users unknowingly/unexpectedly installing different code. ---
**Author:** ![jlmitch5](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jlmitch5/32/578_2.png) [@jlmitch5](https://forum.ansible.com/u/jlmitch5)\ **Post date:** [October 3, 2023, 1:23pm UTC](https://forum.ansible.com/t/user-ownership-for-namespace-is-getting-changed-to-a-different-user/1361/2 "2023-10-03T13:23:51Z")
@lkiesow sorry you experienced this. can you check again? We believe we resolved all cases of this yesterday. ---
**Author:** ![lkiesow](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/lkiesow/32/941_2.png) [@lkiesow](https://forum.ansible.com/u/lkiesow)\ **Post date:** [October 3, 2023, 1:51pm UTC](https://forum.ansible.com/t/user-ownership-for-namespace-is-getting-changed-to-a-different-user/1361/3 "2023-10-03T13:51:19Z")
The problem persists. Installing roles may still install foreign code. For example, installing `elan.opencast_user` tries to get the code from the GitHub user `elan`. That means that user could easily have malicious code deployed for everyone using that role. ```auto ❯ ansible-galaxy install elan.opencast_user Starting galaxy role install process - downloading role 'opencast_user', owned by elan - downloading role from https://github.com/elan/opencast_user/archive/master.tar.gz [ERROR]: failed to download the file: HTTP Error 404: Not Found ``` That’s a huge security risk. You will also find this [in the Ansible Galaxy NG user interface](https://galaxy.ansible.com/ui/search/?keywords=opencast_user): ![Screenshot from 2023-10-03 15-45-40](https://us1.discourse-cdn.com/ansible/original/1X/54479f8bef7a47b111dbb048eb14916f60dba986.png) The `elan` in this screenshot is another GitHub user which has (maybe unknowingly) taken over the namespace. ---
**Author:** ![jlmitch5](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jlmitch5/32/578_2.png) [@jlmitch5](https://forum.ansible.com/u/jlmitch5)\ **Post date:** [October 3, 2023, 2:01pm UTC](https://forum.ansible.com/t/user-ownership-for-namespace-is-getting-changed-to-a-different-user/1361/4 "2023-10-03T14:01:06Z")
Thank you for the additional info and checking. I understand now this is different than the other issue we were seeing. Also agreed this is serious and something we want to fix ASAP. I’ll update once we have. Just a heads up that we will probably move these messages to a separate thread to keep track of the separate issues. ---
**Author:** ![lkiesow](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/lkiesow/32/941_2.png) [@lkiesow](https://forum.ansible.com/u/lkiesow)\ **Post date:** [November 1, 2023, 3:46pm UTC](https://forum.ansible.com/t/user-ownership-for-namespace-is-getting-changed-to-a-different-user/1361/5 "2023-11-01T15:46:23Z")
@jlmitch5, any update to this? The issue still seems to exist. The `elan` roles are still linked to the GitHub user `elan`: ![Screenshot from 2023-11-01 16-43-17](https://us1.discourse-cdn.com/ansible/original/2X/9/945bab314f792594f7453c425c5f46967a4e0a99.png) [https://galaxy.ansible.com/ui/standalone/namespaces/8850/](https://galaxy.ansible.com/ui/standalone/namespaces/8850/) It’s a serious problem which now exists for over a month. ---
**Author:** ![tannerjc](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/tannerjc/32/985_2.png) [@tannerjc](https://forum.ansible.com/u/tannerjc)\ **Post date:** [November 1, 2023, 5:50pm UTC](https://forum.ansible.com/t/user-ownership-for-namespace-is-getting-changed-to-a-different-user/1361/6 "2023-11-01T17:50:43Z")
There are some important distinctions to be made here … 1. Roles in the “elan” namespace are linked to the “elan” provider namespace, which is owned by two users currently ikiesow&tibroc … [elan legacy namespace](https://galaxy.ansible.com/ui/standalone/namespaces/8850/) [elan provider namespace](https://galaxy.ansible.com/ui/namespaces/elan/?tab=access) 2. The installs were fixed a few days ago by patches we rolled out to production and some scripted cleanup on duplicate roles … ```auto [jtanner@p1 tmp]$ rm -rf ~/.ansible /tmp/roles ; ansible-galaxy install -p roles elan.opencast_user Starting galaxy role install process - downloading role 'opencast_user', owned by elan - downloading role from https://github.com/elan-ev/opencast_user/archive/main.tar.gz - extracting elan.opencast_user to /tmp/roles/elan.opencast_user - elan.opencast_user (main) was installed successfully ``` 1. The “elan” namespaces are not in fact pointing at [elan (Elan Feingold) · GitHub](https://github.com/elan) nor are they owned by that github user. The problem is a bug in the galaxy backend that assembles the avatar url in a very naive way… [serializer](https://github.com/ansible/galaxy_ng/blob/master/galaxy_ng/app/api/v1/serializers.py#L330) ```auto return { 'dependencies': dependencies, 'namespace': { 'id': obj.namespace.id, 'name': obj.namespace.name, 'avatar_url': f'https://github.com/{obj.namespace.name}.png' }, 'provider_namespace': provider_ns, 'repository': repository, 'tags': tags, 'versions': versions } ``` That url needs to come from the provider namespace’s metadata instead … ```auto [jtanner@p1 tmp]$ curl -s -L http://galaxy.ansible.com/api/v3/namespaces/?name=elan | jq .data[].avatar_url "https://avatars.githubusercontent.com/u/1064602?s=200&v=4" ``` I’ll work on a patch to fix that. 1. Having roles on galaxy with a namespace that match some other github user’s name is always going to be confusing to end users. What would be helpful is if all the elan.\* roles were renamed to elan-ev to better match the real github source. Is that something you’ve considered?