saltstack / saltstack/salt

[BUG] zypperpkg refresh_db does not support skip_verify

Open
#63,160 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug needs-triage openSUSE
Dominant language
Python
Stars
15.7k
Forks
5.6k
Avg merge
2d 44m
Merged PRs (30d)
80

Description

Description
When installing a package on OpenSUSE while having an invalid signature on a separate repository, the installation fails despite having skip_verify set True.

Setup
Set up an OpenSUSE installation (I enjoy Tumbleweed). Install a repository with a bad signature; the Microsoft Teams repository is a good one. Create a state that installs a package:

Install btop:
    pkg.installed:
        - pkg: btop
        - skip_verify: True

Run the state with debug output. Note that the repositories are first refreshed, but without the --no-gpg-checks switch:

[DEBUG   ] Calling Zypper: zypper --non-interactive refresh --force

Running that command fails unless --no-gpg-checks is used, which is what skip_verify should tell it to do.

skip_verify should be passed to refresh_db here; then added to the function signature. If present, prepend "--no-gpg-checks" to refresh_opts before the command is called.

I expect this issue to affect anything that uses it, but for completeness, I've tested only with this environment.

  • on-prem machine
  • VM (Virtualbox, KVM, etc. please specify)
  • VM running on a cloud service, please be explicit and add details
  • container (Kubernetes, Docker, containerd, etc. please specify)
  • or a combination, please be explicit
  • jails if it is FreeBSD
  • classic packaging
  • used bootstrap to install

Expected behavior
If skip_verify is True on an install state, then verification should also be skipped during package refresh.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in salt/modules/zypperpkg.py at refresh_db around lines 1405 and 1440, then inspect the install call around line 1610. Confirm how skip_verify reaches the refresh operation and verify that an install with skip_verify=True refreshes repositories using the no-GPG-checks behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
devops
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.