From bd093c50efffa89ef63d43ff87f10d1dab9b4fc8 Mon Sep 17 00:00:00 2001 From: Muhammad Azam Date: Mon, 31 Aug 2026 09:47:01 -0400 Subject: [PATCH] Add checksum support for Platform RPMs (PE-1667) Some customers require RPM checksums to be validated before install. Add an optional checksum parameter to the get_url task that downloads Platform RPMs from a repository (Nexus/JFrog/etc.), sourced from a new platform_package_checksums dict keyed by download URL. URLs with no matching entry are downloaded without verification, preserving today's default behavior for anyone who doesn't opt in. Only the repository-download (get_url) path is affected. The local/ manual-upload path uses the copy module, which has no checksum parameter, and was out of scope for this ticket. Tested end-to-end against a live EC2 instance (Rocky Linux 9, AIO topology), using the real Itential Platform 6.5.1 RPM from Nexus and its officially published .sha256 checksum: - Positive test: platform_package_checksums set to the real published checksum (sha256:440353320215dcc737184744579362d78400da0bc46839fa4 f6d220129843531). Ran `ansible-playbook itential.deployer.platform` - the download task succeeded ("msg": "OK (134380937 bytes)", status_code 200), Platform installed and itential-platform.service came up active. - Negative test: same run, with platform_package_checksums changed to a deliberately wrong all-zero value. The download task failed immediately: "The checksum for .../itential-platform-6.5.1-1.noarch.rpm did not match 0000...0000; it was 440353...843531." confirming get_url is genuinely hashing the downloaded file and comparing it - the computed hash it reports matches the real Nexus-published checksum from the positive test. The play stopped there (failed=1), before the RPM reached the dnf install step. - ansible-lint on both changed task/defaults files passes clean (0 failures, 0 warnings). --- docs/itential_platform_guide.md | 11 +++++++++++ roles/platform/CLAUDE.md | 1 + roles/platform/defaults/main/platform.yml | 7 +++++++ .../tasks/download-platform-archive-from-repo.yml | 4 ++++ 4 files changed, 23 insertions(+) diff --git a/docs/itential_platform_guide.md b/docs/itential_platform_guide.md index 593e02fe..000a8664 100644 --- a/docs/itential_platform_guide.md +++ b/docs/itential_platform_guide.md @@ -71,10 +71,21 @@ These variables will effect how the installation occurs. | `repository_username` | `platform` | String | The username for authentication of the repository. | N/A | | `repository_password` | `platform` | String | The password for authentication of the repository. | N/A | | `repository_api_key` | `platform` | String | The API for authentication of the repository. Can be used instead of username/password for authentication.| N/A | +| `platform_package_checksums` | `platform` | Dictionary | Optional per-URL checksums for `platform_packages` entries downloaded via repository. Keys are the download URL (must match the `platform_packages` entry exactly); values are in the format Ansible's `get_url` module expects, e.g. `sha256:`. URLs with no matching key are downloaded without checksum verification. | `{}` | If `platform_packages` contains URLs, either `repository_api_key` or `repository_username` and `repository_password` must be defined. +To validate a downloaded RPM's checksum, add an entry to `platform_package_checksums` keyed by +that RPM's exact download URL: + +```yaml +platform_packages: + - https://registry.aws.itential.com/repository/PLATFORM/Platform%206/Platform%206.5.1/itential-platform-6.5.1-1.noarch.rpm +platform_package_checksums: + "https://registry.aws.itential.com/repository/PLATFORM/Platform%206/Platform%206.5.1/itential-platform-6.5.1-1.noarch.rpm": "sha256:440353320215dcc737184744579362d78400da0bc46839fa4f6d220129843531" +``` + #### Authentication Variables These variables control authentication and user session behaviors. The following table lists the diff --git a/roles/platform/CLAUDE.md b/roles/platform/CLAUDE.md index caf6b4fd..a95e0b4f 100644 --- a/roles/platform/CLAUDE.md +++ b/roles/platform/CLAUDE.md @@ -49,6 +49,7 @@ Installs and configures Itential Platform (IAP). Handles OS user/directory setup | `platform_package_dependencies` | `glibc-common`, `openldap`, `openldap-clients`, `openssl`, `git` | OS packages required before Platform RPM | | `platform_encryption_key` | (required) | 64-char hex string (256-bit AES key); generate with `openssl rand -hex 32` | | `platform_packages` | (required) | List of RPM package names or download URLs | +| `platform_package_checksums` | `{}` | Optional dict mapping a `platform_packages` download URL to its expected `get_url`-format checksum (e.g. `sha256:`); URLs with no entry are downloaded without verification | | `platform_app_artifacts_enabled` | `false` | Install app artifacts | | `platform_start_service` | `true` | Start the service after install | | `platform_upload_using_rsync` | `false` | Use rsync for artifact upload | diff --git a/roles/platform/defaults/main/platform.yml b/roles/platform/defaults/main/platform.yml index d2b97e4e..54a82687 100644 --- a/roles/platform/defaults/main/platform.yml +++ b/roles/platform/defaults/main/platform.yml @@ -54,3 +54,10 @@ platform_start_service: true # Default location for the certification report files platform_certify_report_dir_remote: /var/tmp/itential-reports/platform platform_certify_report_dir_local: /tmp/itential-reports/platform + +# Optional per-URL checksums for platform_packages entries downloaded via repository +# (get_url), for customers who require validated downloads. Keys are the download URL +# (must match the platform_packages entry exactly); values are in the format Ansible's +# get_url module expects, e.g. "sha256:". Entries with no matching key are +# downloaded without checksum verification (today's default behavior). +platform_package_checksums: {} diff --git a/roles/platform/tasks/download-platform-archive-from-repo.yml b/roles/platform/tasks/download-platform-archive-from-repo.yml index 49eccfc9..10880086 100644 --- a/roles/platform/tasks/download-platform-archive-from-repo.yml +++ b/roles/platform/tasks/download-platform-archive-from-repo.yml @@ -24,5 +24,9 @@ url_username: "{{ repository_username | default(omit) }}" url_password: "{{ repository_password | default(omit) }}" validate_certs: true + # Optional per-URL checksum (e.g. "sha256:abcdef...") for customers who require + # validated downloads. Omitted (no verification) when this URL has no entry in + # platform_package_checksums. + checksum: "{{ platform_package_checksums[artifact] | default(omit) }}" register: platform_package_download_result changed_when: false