search

chocolatey / chocolatey-ansible

The Chocolatey module collection for Ansible
GNU General Public License v3.0
49 stars 30 forks source link

win_chocolatey - add options for specifying checksums #114

Closed Harliff closed 1 year ago

Harliff commented 1 year ago

Checklist

Is Your Feature Request Related To A Problem? Please describe.

Sometimes we all need to install a chocolatey package for which the original installer package has been updated but the maintainer has not yet updated the checksum in the chocolatey script. Currently, the only way to install such Chocolatey package is to completely ignore the checksum (by seting "ignore_checksums = yes"), but this is not a very secure way. Ignoring the checksum can be dangerous: it makes users vulnerable to attacks such as MITM and "watering hole".

Can we mitigate it? Yes, we can!

Describe The Solution. Why is it needed?

The solution is to allow the user of the win_chocolatey module to provide the checksum themselves.

Implementing the use of the provided checksum to check the integrity of the downloaded installer does not seem like a difficult task, because the Chocolatey itself has an options to use a custom checksum.

Additional Context

Related documentation:

Related Issues

No response

Harliff commented 1 year ago

The implementation can be quite simple (using only one checksum and fail if it's wrong) and advanced (using the provided checksum as a fallback if the checksum provided by the package maintainer differs from the actual checksum of the download installer). Using the checksum as a fallback can be useful because a playbook/role will continue to work even when the installer publisher releases a new version and the Chocolatey package maintainer updates the checksum in the Chocolatey script.

matglas commented 1 year ago

This feature should be really helpful. I have not been able to use any option for arguments to add the checksum and having this as an input ansible properties would be really helpful.

vexx32 commented 1 year ago

Yeah, this sounds like a great idea 🙂

The implementation can be quite simple (using only one checksum and fail if it's wrong) and advanced (using the provided checksum as a fallback if the checksum provided by the package maintainer differs from the actual checksum of the download installer).

@Harliff I think that your suggestion for the "advanced" case would be... difficult to do in any kind of reasonable way short of just re-attempting the install, as it's not a thing Chocolatey supports natively (as far as I recall). I'm not sure that's an especially great way for it to work UX-wise.

Rather, I would encourage you to make that feature request into https://github.com/chocolatey/choco itself, and the collection can then use that functionality by proxy.