cisagov / ansible-role-openvpn

Ansible role to install an OpenVPN server and configure it to authenticate users certificates against FreeIPA.
Creative Commons Zero v1.0 Universal
8 stars 2 forks source link

Get rid of srvlookup dependency #71

Open jsf9k opened 1 year ago

jsf9k commented 1 year ago

💡 Summary

We should consider getting rid of the srvlookup dependency.

Motivation and context

On Debian Bookworm, pip now correctly identifies the system Python as being "externally managed" and balks when you try to install pip packages under it. Thus, pip is enforcing the wise rule to only install Python packages under the system python via system packages; if really need to install packages via pip then you should be using a venv.

Unfortunately neither Debian nor RedHat offers a system package for the srvlookup Python package, and it is the only remaining pip package that we are installing. All the other dependencies have been changed to be satisfied via system packages.

mcdonnnj commented 1 year ago

An alternative option is to repackage the verify-cn.py script as a Python package (with an entrypoint) and install it through pipx.