Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: make sure binary install dir exists #423

Merged
merged 1 commit into from
Oct 24, 2024
Merged

fix: make sure binary install dir exists #423

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions roles/_common/tasks/install.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,6 +104,24 @@
check_mode: false
when: __common_binary_basename is search('\.zip$|\.tar\.gz$')

- name: "Check existence of binary install dir"
ansible.builtin.stat:
path: "{{ _common_binary_install_dir }}"
register: __common_binary_install_dir
Comment on lines +107 to +110
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wrote this with reference to below format:

ansible/roles/systemd_exporter/tasks/preflight.yml

Lines 42 to 50 in f3514a9

- name: Check existence of TLS key file
ansible.builtin.stat:
path: "{{ systemd_exporter_tls_server_config.key_file }}"
register: __systemd_exporter_key_file
- name: Assert that TLS key and cert are present
ansible.builtin.assert:
that:
- "__systemd_exporter_cert_file.stat.exists"


- name: "Make sure binary install dir exists"
ansible.builtin.file:
path: "{{ _common_binary_install_dir }}"
mode: 0755
owner: root
group: root
Comment on lines +115 to +117
Copy link
Contributor

@SuperQ SuperQ Oct 18, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure we should be explicitly changing these permissions, given this is /usr/local/bin by default.

For example, if this is a symlink, I'm pretty sure this will break the system.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The mode/owner has to be set because of https://nvd.nist.gov/vuln/detail/CVE-2020-1736
But I agree that we should use stat first to be on the safe side.

become: true
tags:
- "{{ ansible_parent_role_names | first | regex_replace(ansible_collection_name ~ '.', '') }}"
- install
- "{{ ansible_parent_role_names | first | regex_replace(ansible_collection_name ~ '.', '') }}_install"
when: not __common_binary_install_dir.stat.exists

- name: "Propagate binaries"
ansible.builtin.copy:
src: "{{ _common_local_cache_path }}/{{ item }}"
Expand Down
Loading