Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] pkg.installed does not honor verify_ssl for cp.cache_file #63981

Closed
amalaguti opened this issue Mar 28, 2023 · 0 comments
Closed

[BUG] pkg.installed does not honor verify_ssl for cp.cache_file #63981

amalaguti opened this issue Mar 28, 2023 · 0 comments
Assignees
Labels
Bug broken, incorrect, or confusing behavior Execution-Module State-Module Windows

Comments

@amalaguti
Copy link

Description
This came out when trying to use pkg.installed with a winrepo pkg for which installer was on an https:// location with a self-signed certificate.

[WARNING ] SSL Error on 1580 ('172.22.99.3', 443): [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:1131)
[ERROR   ] Failed to cache https://redacted/artifactory/local/NessusAgent-10.3.2-x64.msi

verify_ssl is set to True by default in cp.cache_file and the argument is not honored by pkg.installed by passing it to the function.

We did some minor changes to the existing minion code (Windows minion version 3005.1)

# Add verify_ssl option to win_pkg.py (state and execution module) so it's honored by cp.cache_file
On modules/win_pkg.py:

# 1673:
            if not cached_pkg:
                # It's not cached. Cache it, mate.
                try:
                    cached_pkg = __salt__["cp.cache_file"](installer, saltenv, verify_ssl=kwargs.get("verify_ssl"))

# Pass all kwargs to cp.cache_file
On states/pkg.py:
# 756:
# Metadata parser is available, cache the file and derive the
# package's name and version
            err = "Unable to cache {0}: {1}"
            try:
                cached_path = __salt__["cp.cache_file"](
                    version_string, saltenv=kwargs["saltenv"], **kwargs
                )

These changes allow pkg.installed to pass verify_ssl to cp.cache_file
install:
pkg.installed:
- name: putty
- verify_ssl: False

Setup
3005.1 and lower
winrepo set to retrive installer from https:// using a self-signed certificate

Steps to Reproduce the behavior
Setup a winrepo package with a installer located in https:// with self-signed certificate
Use pkg.installed on windows minion to install the package

Expected behavior
pkg.installed should honor verify_ssl for cp.cache_file

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Bug broken, incorrect, or confusing behavior Execution-Module State-Module Windows
Projects
None yet
Development

No branches or pull requests

2 participants