intel / ccc-linux-guest-hardening

Linux Security Hardening for Confidential Compute
https://intel.github.io/ccc-linux-guest-hardening-docs
MIT License
64 stars 13 forks source link

Unexpected Exception, this is probably a bug: Non integer values in LooseVersion #75

Closed Wenzel closed 1 year ago

Wenzel commented 1 year ago

ansible-lint is running into a probable Ansible bug when linting the collection: https://github.com/intel/ccc-linux-guest-hardening/actions/runs/3617034886/jobs/6095529541

Warning: [WARNING]: The specified collections path '/home/runner/.cache/ansible-
compat/b7bd55/collections' is not part of the configured Ansible collections
paths '/home/runner/.ansible/collections:/usr/share/ansible/collections'. The
installed collection won't be picked up in an Ansible run.
ERROR! Unexpected Exception, this is probably a bug: Non integer values in LooseVersion ('master')

Got 250 exit code while running: ansible-galaxy collection install -v -r requirements.yml -p /home/runner/.cache/ansible-compat/b7bd55/collections

When running the previous commands with high verbosity:

./venv/bin/ansible-galaxy collection install -v -r requirements.yml -p /home/mtarral/.cache/ansible-compat/b7bd55/collections -vvv
ansible-galaxy [core 2.13.6]
  config file = /xxx/ansible.cfg
  configured module search path = ['/home/mtarral/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /xxx/venv/lib/python3.8/site-packages/ansible
  ansible collection location = /home/mtarral/.ansible/collections:/usr/share/ansible/collections
  executable location = ./venv/bin/ansible-galaxy
  python version = 3.8.10 (default, Jun 22 2022, 20:18:18) [GCC 9.4.0]
  jinja version = 3.1.2
  libyaml = True
Using /xxx/ansible.cfg as config file
Reading requirement file at '/xxx/requirements.yml'
Starting galaxy collection install process
[WARNING]: The specified collections path '/home/mtarral/.cache/ansible-compat/b7bd55/collections' is not part of the configured Ansible collections paths
'/home/mtarral/.ansible/collections:/usr/share/ansible/collections'. The installed collection won't be picked up in an Ansible run.
Found installed collection intellabs.kafl:1.0.0 at '/home/mtarral/.cache/ansible-compat/b7bd55/collections/ansible_collections/intellabs/kafl'
ERROR! Unexpected Exception, this is probably a bug: Non integer values in LooseVersion ('master')
the full traceback was:

Traceback (most recent call last):
  File "/xxx/venv/lib/python3.8/site-packages/ansible/cli/__init__.py", line 601, in cli_executor
    exit_code = cli.run()
  File "/xxx/venv/lib/python3.8/site-packages/ansible/cli/galaxy.py", line 682, in run
    return context.CLIARGS['func']()
  File "/xxx/venv/lib/python3.8/site-packages/ansible/cli/galaxy.py", line 104, in method_wrapper
    return wrapped_method(*args, **kwargs)
  File "/xxx/venv/lib/python3.8/site-packages/ansible/cli/galaxy.py", line 1327, in execute_install
    self._execute_install_collection(
  File "/xxx/venv/lib/python3.8/site-packages/ansible/cli/galaxy.py", line 1364, in _execute_install_collection
    install_collections(
  File "/xxx/venv/lib/python3.8/site-packages/ansible/galaxy/collection/__init__.py", line 672, in install_collections
    unsatisfied_requirements -= set() if force or force_deps else {
  File "/xxx/venv/lib/python3.8/site-packages/ansible/galaxy/collection/__init__.py", line 676, in <setcomp>
    if req.fqcn == exs.fqcn and meets_requirements(exs.ver, req.ver)
  File "/xxx/venv/lib/python3.8/site-packages/ansible/galaxy/dependency_resolution/versioning.py", line 63, in meets_requirements
    SemanticVersion.from_loose_version(LooseVersion(requirement)),
  File "/xxx/venv/lib/python3.8/site-packages/ansible/utils/version.py", line 178, in from_loose_version
    raise ValueError("Non integer values in %r" % loose_version)
ValueError: Non integer values in LooseVersion ('master')

The loose_version seems to be master. Debugging that with pdb with up in the stack frame: galaxy.py:_execute_install_collection()

        install_collections(
            requirements, output_path, self.api_servers, ignore_errors,
            no_deps, force, force_with_deps, upgrade,
            allow_pre_release=allow_pre_release,
            artifacts_manager=artifacts_manager,
            disable_gpg_verify=disable_gpg_verify,
        )

with requirements:

(Pdb++) requirements
[<intellabs.kafl:master of type 'git' from git+https://github.com/IntelLabs/kAFL#/deploy/intellabs/>]

So it seems that specifying a master branch in our requirements.yml, and not a specific version with SemVer format is what's troubling Ansible here.

Dockerfile to repro the bug

This Dockerfile will help to make a bug report against ansible

FROM python:3.8

RUN pip install ansible-core==2.13.3 ansible==6.3.0 ansible-lint==6.3.0
WORKDIR /bug
RUN wget 'https://raw.githubusercontent.com/intel/ccc-linux-guest-hardening/master/deploy/requirements.yml'
RUN ansible-galaxy install -r requirements.yml --force
ENTRYPOINT ["ansible-lint"]