Problem: Archivematica ansible role fails when using custom facts in remote server and AWX with ansible 2.15 (get_url with become_user module)

[mamedin]

Expected behaviour

The archivematica role should work

Current behaviour

When using custom facts in remote server to speed up the deployment (see ) and AWX with ansible 2.15, the get_url module requires allow_world_readable_tmpfiles: true and fails with the following:

Steps to reproduce

Deploy AM1.15 (it only fails the first time AM is deployed from AWX) with AWX, ansible 2.15 and having custom facys in remote server

Your environment (version of Archivematica, operating system, other relevant details)

AWX with ansible 2.15 Remote server: AM 1.15, Ubuntu 22.02, using ansible custom facts

---

For Artefactual use:

Before you close this issue, you must check off the following:

• [ ] All pull requests related to this issue are properly linked
• [ ] All pull requests related to this issue have been merged
• [ ] A testing plan for this issue has been implemented and passed (testing plan information should be included in the issue body or comments)
• [ ] Documentation regarding this issue has been written and merged (if applicable)
• [ ] Details about this issue have been added to the release notes (if applicable)

[mamedin]

It was not happening in AM<1.15 because we were downloading and installing pip as root user.

The issue is located in the following task:

  - name: "Download get-pip.py in archivematica userdir"
    become: "yes"
    become_user: "archivematica"
    get_url:
      url: "https://bootstrap.pypa.io/get-pip.py"
      force: "yes"
      dest: "/var/lib/archivematica/get-pip.py"

Using the following task we can skip the become_user option in get_url module:

  - name: "Download get-pip.py in archivematica userdir"
    get_url:
      url: "https://bootstrap.pypa.io/get-pip.py"
      force: "yes"
      dest: "/var/lib/archivematica/get-pip.py"
      owner: "archivematica"
      group: "archivematica"

Installing the acl package in remote server we can fix the allow_world_readable_tmpfiles: true issue.

[mamedin]

Thanks @rayzilt for reporting and helping with troubleshooting ;)

[mamedin]

PR merged in qa/1.x and stable/1.15.x branches