adoptium / adoptium/infrastructure

Update ansible playbooks to use up-to-date version of git

Open
#2,889 4 comments 0 reactions 0 assignees View on GitHub
ansible currency
Dominant language
Python
Stars
96
Forks
106
Avg merge
1d 23h
Merged PRs (30d)
13

Description

The Git project has now released new versions of git to fix recent security vulnerabilities, and since the playbooks are installing git built from source of version 2.15.0 (from October 2017), changing them to use the fixed version (2.39.1) would help with ensuring that the systems we configure with them are fixed also.

https://github.blog/2023-01-17-git-security-vulnerabilities-announced-2/

Searching the playbooks for "git" hits on 97 files most of which are likely to be unrelated to the installation of git itself, but will still need checking. However, searching on "git --version" found these 5, all of which will definitely need updating:
```
% find . -type f -exec grep -li "git --version" {} \;
./AdoptOpenJDK_Unix_Playbook/roles/Common/tasks/Solaris.yml
./AdoptOpenJDK_Unix_Playbook/roles/Common/tasks/SLES.yml
./AdoptOpenJDK_Unix_Playbook/roles/GIT_Source/tasks/main.yml
./vagrant.yml
./AdoptOpenJDK_ITW_Playbook/roles/GIT_Source/tasks/main.yml
%
```

I checked the Dockerfiles also, but they don't include any hard-coded git versions.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the five files identified by the issue: the Solaris.yml and SLES.yml task files, both GIT_Source/tasks/main.yml files, and vagrant.yml. Search those files and the remaining playbooks for hard-coded Git versions, then verify that the playbooks install the fixed 2.39.1 version and complete their existing checks successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
ansible, git
Domain
devops, infrastructure, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.